create-mastra@1.31.0

Create Mastra apps with one command

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package has no install lifecycle hook, but its default CLI path installs Mastra agent skills into a newly generated project. That is a concrete first-party agent-extension setup risk and warrants a warning.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Running the create-mastra CLI to generate a project without disabling skills.

Impact

This can modify the generated project's agent-extension configuration and retrieves an external skills package; the source does not show credential theft, destructive behavior, or a lifecycle-triggered attack.

Mechanism

After project creation, it detects coding-agent executables and runs npx skills add in the generated project directory.

AI rationale

Evidence

dist/index.js

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package exposes a user-invoked CLI entrypoint.
The create flow enables skills installation by default.
The CLI invokes npx to add Mastra skills for detected coding-agent integrations in the newly created project.

Evidence against

No npm preinstall, install, or postinstall hook is declared in the manifest.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 757 KB of source, external domains: app.posthog.com, eu-assets.i.posthog.com, eu.i.posthog.com, gateway-api.mastra.ai, gateway-api.staging.mastra.ai, github.com, mastra.ai, platform.mastra.ai, posthog.com, projects.mastra.ai, raw.githubusercontent.com, sentry.io, studio.mastra.ai, studio.staging.mastra.ai, us-assets.i.posthog.com, us.i.posthog.com, us.posthog.com, yandex.com

Source & flagged code

8 flagged

dist/credentials-Cgc5DcYQ-Cfe8N7V8.jsView file

Lines 1-33javascript

1import { t as MASTRA_PLATFORM_API_URL } from "./client-CdJ_HgDO-BKCiJhNz.js";

2import { createRequire } from "node:module";

3import "node:path";

4import process$1, { stdin, stdout } from "node:process";

5import { randomBytes } from "crypto";

6import { readFileSync as readFileSync$1 } from "fs";

7import { homedir, release } from "os";

8import { join } from "path";

9import { chmod, mkdir, readFile, writeFile } from "fs/promises";

10import { styleText } from "node:util";

11import * as l from "node:readline";

12import l__default from "node:readline";

13import { ReadStream } from "node:tty";

14import { execFileSync } from "child_process";

15import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/credentials-Cgc5DcYQ-Cfe8N7V8.jsView on unpkg · L13

16//#region \0rolldown/runtime.js

17var __create = Object.create;

18var __defProp = Object.defineProperty;

19var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

20var __getOwnPropNames = Object.getOwnPropertyNames;

21var __getProtoOf = Object.getPrototypeOf;

22var __hasOwnProp = Object.prototype.hasOwnProperty;

23var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);

24var __copyProps = (to, from, except, desc) => {

25 if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i <

26 key = keys[i];

27 if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {

28 get: ((k) => from[k]).bind(null, key),

29 enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable

30 });

31 }

32 return to;

33};

dist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1View file

294if (!inSurrogate) { L295: inSurrogate = character >= "\ud800" && character <= "\udbff";\n\t\t\tif (inSurrogate) continue;\n\t\t} else inSurrogate = false;\n\t\tif (character === ESC || character === CSI) {\... L296: return (await login(signal, options)).token;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1View on unpkg · L294

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1View on unpkg · L294

294Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js -> dist/credentials-Cgc5DcYQ-Cfe8N7V8.js L294: if (!inSurrogate) { L295: inSurrogate = character >= "\ud800" && character <= "\udbff";\n\t\t\tif (inSurrogate) continue;\n\t\t} else inSurrogate = false;\n\t\tif (character === ESC || character === CSI) {\... L296: return (await login(signal, options)).token;

dist/index.jsView file

5import { EventEmitter, addAbortListener, on, once, setMaxListeners } from "node:events"; L6: import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process"; L7: import path, { basename, delimiter, dirname, isAbsolute, normalize, resolve } from "node:path"; ... L36: * Constructs the CommanderError class L37: * @param {number} exitCode suggested exit code which could be used with process.exit L38: * @param {string} code an id string representing the error ... L182: * @return {string} L183: * @private L184: */ ... L197: * TypeScript import types for JSDoc, used by Visual Studio Code IntelliSense and `npm run typescript-checkJS` L198: * https://www.typescriptlang.org/docs/handbook/jsdoc-supported-types.html#import-types L199: * @typedef { import("./argument.js").Argument } A

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg · L5

5Trigger-reachable chain: manifest.main -> dist/index.js L5: import { EventEmitter, addAbortListener, on, once, setMaxListeners } from "node:events"; L6: import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process"; L7: import path, { basename, delimiter, dirname, isAbsolute, normalize, resolve } from "node:path"; ... L36: * Constructs the CommanderError class L37: * @param {number} exitCode suggested exit code which could be used with process.exit L38: * @param {string} code an id string representing the error ... L182: * @return {string} L183: * @private L184: */ ... L197: * TypeScript import types for JSDoc, used by Visual Studio Code IntelliSense and `npm run typescript-checkJS` L198: * https://www.typescriptlang.org/docs/handbook/jsdoc-supported-types.html#import-types

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L5

Source & flagged code

8 flagged · loading source

dist/credentials-Cgc5DcYQ-Cfe8N7V8.jsView file

13import { ReadStream } from "node:tty"; L14: import { execFileSync } from "child_process"; L15: import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/credentials-Cgc5DcYQ-Cfe8N7V8.jsView on unpkg · L13

dist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1View on unpkg · L294

Findings

2 Critical6 High3 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processdist/credentials-Cgc5DcYQ-Cfe8N7V8.js

HighSame File Env Network Executiondist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1

HighCommand Output Exfiltrationdist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1

HighSandbox Evasion Gated Capabilitydist/index.js

HighTrigger Reachable Command Output Exfiltrationdist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1

HighSemantic Analysis Limiteddist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to create-mastra@1.31.0.

See all versions of create-mastra for other recorded verdicts.

Review the evidence and your use of create-mastra@1.31.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-22 15:43:50.852Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code