create-factory@0.3.0
⚠ Under reviewCreate a Mastra Factory project: an agent-powered software delivery environment built on Mastra. Run `npm create factory` to scaffold and get started.
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe package’s CLI and available dependencies were inspected, and no concrete malicious behavior was confirmed. The active mastra@1.35.0 dependency source is unresolved, so its analytics and authentication behavior remains unverified.
Decision evidence
public snapshot- package.json declares mastra@1.35.0, and dist/index.js imports its analytics and authentication modules; the dependency behavior could not be verified from the available source.
- The CLI initializes PostHog analytics and tracks command execution when the CLI action runs; inspected source does not establish a concrete attack.
- The inspected telemetry call passes command options such as platform choice, organization presence, and region; it is reached through the CLI action.
Source & flagged code
4 flaggedpackage.json declares mastra@1.35.0, and dist/index.js imports its analytics and authentication modules; the dependency behavior could not be verified from the available source.
package.jsonView on unpkg · L34package.json declares mastra@1.35.0, and dist/index.js imports its analytics and authentication modules; the dependency behavior could not be verified from the available source.
dist/index.jsView on unpkg · L6Findings
Affected versions and remediation
This report applies to create-factory@0.3.0.
See all versions of create-factory for other recorded verdicts.
- Review the evidence and your use of create-factory@0.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.