@mastra/server@1.77.0
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe source exposes agent-invoked shell execution, a powerful dual-use capability that warrants a warning. The flagged credential handling is consistent with authentication to the Vercel AI Gateway and does not establish credential theft.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
An application or agent invokes the exposed execute-command tool.
Impact
Commands can affect the environment available to the application; the inspected path does not establish an unrequested command trigger.
Mechanism
The tool passes its supplied command to a child process and may return captured output.
AI rationale
The source exposes agent-invoked shell execution, a powerful dual-use capability that warrants a warning. The flagged credential handling is consistent with authentication to the Vercel AI Gateway and does not establish credential theft.
Evidence
dist/dist-Cfv3ewR4.cjs
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The agent builder exposes an execute-command tool that accepts a command and working directory.
- The tool passes the supplied command to child_process.exec and can return its output.
Evidence against
- The flagged credential path uses the Vercel AI Gateway provider, with a configurable base URL and a gateway-specific token.
- The top-level package entrypoint throws and directs callers to specific subpaths.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
6 flagged · loading sourcedist/dist-Cfv3ewR4.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @mastra/server@1.66.0
matchedIdentity = npm:QG1hc3RyYS9zZXJ2ZXI:1.66.0
similarity = 0.517
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/dist-Cfv3ewR4.cjsView on unpkg30let async_hooks = require("async_hooks");
L31: let child_process = require("child_process");
L32: let fs_promises = require("fs/promises");
High
Child Process
Package source references child process execution.
dist/dist-Cfv3ewR4.cjsView on unpkg · L3030Cross-file remote execution chain: dist/dist-Cfv3ewR4.cjs spawns dist/dist-Bw2XgCSY.cjs; helper contains network access plus dynamic code execution.
L30: let async_hooks = require("async_hooks");
L31: let child_process = require("child_process");
L32: let fs_promises = require("fs/promises");
...
L711: }
L712: fetch(e, t = {}) {
L713: let i = W.hasSubscribers, { status: s = R() ? {} : void 0 } = t;
...
L4831: if (hasBuffer && Buffer.isBuffer(text)) text = text.toString();
L4832: if (text && text.charCodeAt(0) === 65279) text = text.slice(1);
L4833: const obj = JSON.parse(text, reviver);
...
L6536: type: "redacted_reasoning",
L6537: value: { data: value.data }
L6538: };
Findings
1 Critical5 High2 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/dist-Cfv3ewR4.cjs
HighChild Processdist/dist-Cfv3ewR4.cjs
HighShell
HighCredential Redirect Persistencedist/dist-aAfueiQI.js
HighCross File Remote Execution Contextdist/dist-Cfv3ewR4.cjs
HighSemantic Analysis Limiteddist/sync-Ai_ZDz7U.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldist/schema-e0VHpMt0-BS9KHnuT.cjs
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @mastra/server@1.77.0.
See all versions of @mastra/server for other recorded verdicts.
- Review the evidence and your use of @mastra/server@1.77.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.