registry / @mastra/stagehand / 0.3.6
@mastra/stagehand@0.3.6
⚠ Under reviewAI-powered browser automation for Mastra agents using Stagehand
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe inspected package wrapper shows ordinary browser automation behavior and no install hook. The selected runtime dependency is unresolved in the supplied snapshot, which prevents a clean verdict.
Static reason
No blocking static signals were detected.
Trigger
Browser launch through the exported runtime API.
Impact
The wrapper alone does not establish an attack, but the dependency behavior remains unresolved.
Mechanism
The wrapper initializes Stagehand and provides browser tools; the imported dependency implementation was unavailable for inspection.
AI rationale
The inspected package wrapper shows ordinary browser automation behavior and no install hook. The selected runtime dependency is unresolved in the supplied snapshot, which prevents a clean verdict.
Evidence
package.jsondist/index.js
Decision evidence
public snapshotAI called this Manual Review at 91.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json declares no install lifecycle hooks.
- The runtime entrypoint imports the declared Stagehand dependency and initializes it when the browser launches.
- The reviewed wrapper exposes browser action, extraction, observation, navigation, tab, close, and screenshot tools.
Evidence against
- The selected runtime dependency @browserbasehq/stagehand is unresolved in the supplied source snapshot, so its behavior could not be reviewed.
Behavioral surface
Filesystem
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
24"license": "Apache-2.0",
"dependencies": {
"@browserbasehq/stagehand": "^3.2.1"
},
"devDependencies": {
"@types/node": "22.20.1",
"@vitest/coverage-v8": "4.1.11
Low
Suspicious Lifecycle Evidence
package.json declares no install lifecycle hooks.
package.jsonView on unpkg · L24dist/index.jsView file
1import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
import { Stagehand } from "@browserbasehq/stagehand";
import { DEFAULT_BROWSER_VIEWPORT, DEFAULT_THRE
Low
Suspicious Dependency Evidence
The runtime entrypoint imports the declared Stagehand dependency and initializes it when the browser launches.
dist/index.jsView on unpkg · L1522it this.buildStagehandOptions();
const stagehand = new Stagehand(stagehandOptions);
await stagehand.init();
return stagehand;
}
async doLaunch() {
this.pendingCloseReasons.clear();
const scope = this.getScope();
this.threadManager.setCr
Findings
6 Low
LowScripts Present
LowFilesystem
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Dependency Evidencedist/index.js
LowSuspicious Dependency Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @mastra/stagehand@0.3.6.
See all versions of @mastra/stagehand for other recorded verdicts.
- Review the evidence and your use of @mastra/stagehand@0.3.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.