registry / @mastra/temporal / 0.4.16

@mastra/temporal@0.4.16

⚠ Under review

Mastra Temporal workflows integration - run Mastra workflows on the Temporal durable execution platform

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 3 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 143 KB of source

Source & flagged code

1 flagged

dist/worker.cjsView file

Lines 3-43javascript

3var __create = Object.create;

4var __defProp = Object.defineProperty;

5var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

6var __getOwnPropNames = Object.getOwnPropertyNames;

7var __getProtoOf = Object.getPrototypeOf;

8var __hasOwnProp = Object.prototype.hasOwnProperty;

9var __copyProps = (to, from, except, desc) => {

10 if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i <

11 key = keys[i];

12 if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {

13 get: ((k) => from[k]).bind(null, key),

14 enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable

15 });

16 }

17 return to;

18};

19var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod ||

20 value: mod,

21 enumerable: true

22}) : target, mod));

23//#endregion

24const require_utils = require("./utils-D94W1i81.cjs");

25let fs = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/worker.cjsView on unpkg · L23

26let fs_promises = require("fs/promises");

27let path = require("path");

28path = __toESM(path, 1);

29let url = require("url");

30let _babel_generator = require("@babel/generator");

31let _babel_parser = require("@babel/parser");

32let _babel_types = require("@babel/types");

33_babel_types = __toESM(_babel_types, 1);

34let rollup = require("rollup");

35let module$1 = require("module");

36//#region src/transforms/shared.ts

37const parserPlugins = [

38 "typescript",

39 "jsx",

40 "decorators-legacy"

41];

42function parseModule(filePath, sourceText) {

43 if (!sourceText) sourceText = (0, fs.readFileSync)(filePath, "utf8");

Source & flagged code

1 flagged · loading source

dist/worker.cjsView file

23//#endregion L24: const require_utils = require("./utils-D94W1i81.cjs"); L25: let fs = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/worker.cjsView on unpkg · L23

Findings

1 Medium2 Low

MediumDynamic Requiredist/worker.cjs

LowScripts Present

LowFilesystem

Affected versions and remediation

This report applies to @mastra/temporal@0.4.16.

See all versions of @mastra/temporal for other recorded verdicts.

Review the evidence and your use of @mastra/temporal@0.4.16 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-15 23:14:50.072Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mastra

Behavioral surface

Related packages

More from @mastra

Source & flagged code