create-factory@0.1.18
Create a Mastra Factory project: an agent-powered software delivery environment built on Mastra. Run `npm create factory` to scaffold and get started.
AI Security Review
scanned 29d ago · by lpm-firewall-aiThe inspected source shows a Mastra project scaffolding CLI without an install lifecycle hook. Its observed telemetry sends limited command-option fields to a configured analytics host, and the dependency aligns with the package's stated Mastra purpose.
Decision evidence
public snapshot- package.json declares the Mastra runtime dependency at version 1.30.0, consistent with this Mastra project creator.
- The manifest lists build, check, test, and lint scripts; it has no install lifecycle script.
- The built CLI defines project creation as a command action, with the Mastra Factory template as its default.
- CLI telemetry sends command options limited to template choice, platform setting, organization presence, and region.
- Telemetry is configured for us.posthog.com.
Source & flagged code
6 flaggedA newly added or changed runtime dependency can resolve to an independently confirmed malicious package version.
package.jsonView on unpkgpackage.json declares the Mastra runtime dependency at version 1.30.0, consistent with this Mastra project creator.
package.jsonView on unpkg · L34The manifest lists build, check, test, and lint scripts; it has no install lifecycle script.
package.jsonView on unpkg · L49Findings
Affected versions and remediation
This report applies to create-factory@0.1.18.
See all versions of create-factory for other recorded verdicts.
- Review the evidence and your use of create-factory@0.1.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.