create-factory@0.4.1
Create a Mastra Factory project: an agent-powered software delivery environment built on Mastra. Run `npm create factory` to scaffold and get started.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe CLI sends runtime usage telemetry to PostHog without disclosure or an opt-out documented in the package README, which warrants a warning. The visible custom fields are coarse command choices, and failure messages are redacted before reporting; I found no evidence of credential or project-content collection.
Decision evidence
public snapshot- The CLI configures PostHog at https://us.posthog.com and registers it as the analytics client.
- The create command automatically reports command execution and coarse option values to analytics.
- The scaffold flow also reports package-manager and platform-choice metadata; the README does not mention analytics or an opt-out.
- The explicit command fields are flags and choices rather than project contents or credentials.
- Before reporting failures, the code redacts supplied project names, template values, organization values, and invalid regions.
- The package has no install lifecycle scripts; its advertised behavior is an interactive project-scaffolding CLI.
Source & flagged code
4 flaggedThe CLI configures PostHog at https://us.posthog.com and registers it as the analytics client.
dist/index.jsView on unpkg · L682The create command automatically reports command execution and coarse option values to analytics.
dist/index.jsView on unpkg · L700The scaffold flow also reports package-manager and platform-choice metadata; the README does not mention analytics or an opt-out.
Findings
Affected versions and remediation
This report applies to create-factory@0.4.1.
See all versions of create-factory for other recorded verdicts.
- Review the evidence and your use of create-factory@0.4.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.