registry / @mastra/server / 1.74.0
@mastra/server@1.74.0
⚠ Under reviewAI Security Review
scanned 6d ago · by lpm-firewall-aiThe inspected excerpts contradict the scanner’s credential-redirection interpretation and show an explicit server-start operation. Required runtime coverage is incomplete, so the full package behavior cannot be resolved from this inspection.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Gateway requests occur when application code uses the gateway provider; process launch occurs when the server-start operation is called.
Impact
The inspected excerpts do not establish credential theft or unconsented system changes.
Mechanism
The inspected gateway path uses gateway authentication, and the server-start operation launches the requested project’s development server.
AI rationale
The inspected excerpts contradict the scanner’s credential-redirection interpretation and show an explicit server-start operation. Required runtime coverage is incomplete, so the full package behavior cannot be resolved from this inspection.
Network endpoints1
ai-gateway.vercel.sh/v1/ai
Decision evidence
public snapshotAI called this Manual Review at 55.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest exposes built runtime entry points and contains no install lifecycle hook in its scripts.
- The gateway code sends its own gateway authentication token to the gateway endpoint; the inspected code does not show provider credentials being redirected there.
- The scanned process launch is an explicit server-start operation using the caller-supplied project path and environment.
Evidence against
- The available inspection did not cover every required runtime source path, so the package’s complete behavior remains unresolved.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
6 flagged · loading sourcedist/dist-D-O086vY.jsView file
30import { AsyncLocalStorage } from "async_hooks";
L31: import { exec, execFile, spawn } from "child_process";
L32: import { copyFile, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "fs/promises";
High
Child Process
Package source references child process execution.
dist/dist-D-O086vY.jsView on unpkg · L30•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/dist-D-O086vY.js:
import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
import { copyFile, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "fs/promises";
throw new Error("@vercel/oidc is not available in the vendored @internal AI packages. Provide an API key instead.");
if (apiKeyProvided) contextualMessage = `AI Gateway authentication failed: Invalid API key.
Create a new API key: https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%2Fapi-keys
Alternatively, use an API key: https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%2Fapi-keys`;
Option 1 - API key:
Create an API key: https://verc
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/dist-D-O086vY.jsView on unpkgdist/schema-e0VHpMt0-BS9KHnuT.cjsView file
3778if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch);
L3779: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get());
L3780: this.scope.value(validateName, { ref: validate });
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/schema-e0VHpMt0-BS9KHnuT.cjsView on unpkg · L3778dist/dist-BACW0Que.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @mastra/server@1.66.0
matchedIdentity = npm:QG1hc3RyYS9zZXJ2ZXI:1.66.0
similarity = 0.600
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/dist-BACW0Que.cjsView on unpkg30Cross-file remote execution chain: dist/dist-BACW0Que.cjs spawns dist/dist-BQ0VOLA9.cjs; helper contains network access plus dynamic code execution.
L30: let async_hooks = require("async_hooks");
L31: let child_process = require("child_process");
L32: let fs_promises = require("fs/promises");
...
L711: }
L712: fetch(e, t = {}) {
L713: let i = W.hasSubscribers, { status: s = R() ? {} : void 0 } = t;
...
L4831: if (hasBuffer && Buffer.isBuffer(text)) text = text.toString();
L4832: if (text && text.charCodeAt(0) === 65279) text = text.slice(1);
L4833: const obj = JSON.parse(text, reviver);
...
L6536: type: "redacted_reasoning",
L6537: value: { data: value.data }
L6538: };
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/dist-BACW0Que.cjsView on unpkg · L30dist/sync-BG15Yae1.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/sync-BG15Yae1.js#virtual:normalized:round1View on unpkgFindings
1 Critical5 High2 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/dist-BACW0Que.cjs
HighChild Processdist/dist-D-O086vY.js
HighShell
HighCredential Redirect Persistencedist/dist-D-O086vY.js
HighCross File Remote Execution Contextdist/dist-BACW0Que.cjs
HighSemantic Analysis Limiteddist/sync-BG15Yae1.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldist/schema-e0VHpMt0-BS9KHnuT.cjs
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @mastra/server@1.74.0.
See all versions of @mastra/server for other recorded verdicts.
- Review the evidence and your use of @mastra/server@1.74.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.