registry / create-factory / 0.1.10
create-factory@0.1.10
Create a Mastra Factory project: an agent-powered software delivery environment built on Mastra. Run `npm create factory` to scaffold and get started.
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 5 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsFilesystem
UrlStrings
Source & flagged code
1 flaggeddist/index.jsView file
•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/index.js:
fs.writeFileSync(envPath, output, { mode: 384 });
await fs$1.writeFile(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
repoUrl.replace("https://github.com/", ""),
fs.copyFileSync(path.join(projectPath, ".env.example"), envPath);
if (platformResult) lines.push(`${color.green("Provisioned on Mastra platform")} in ${color.cyan(platformResult.orgName)}:`, ` - Project ${color.cyan(platformResult.project.name)}...
else if (platformError) lines.push(`${color.yellow("Platform provisioning failed:")} ${platformError}`, `Any credentials that were minted before the failure have been written to ${...
fs.writeFileSync(gitignorePath, `${existing}${prefix}
High
Entrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/index.jsView on unpkgFindings
1 High1 Medium3 Low
HighEntrypoint Foreign Package Code Overwritedist/index.js
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to create-factory@0.1.10.
See all versions of create-factory for other recorded verdicts.
- Review the evidence and your use of create-factory@0.1.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.