create-mastra@1.31.1

Create Mastra apps with one command

AI Security Review

scanned 25d ago · by lpm-firewall-ai

The automatic agent-skill installation is a real first-party agent extension lifecycle risk, though it is reached through an explicit CLI command and no concrete malicious behavior was found.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user runs the create-mastra command with default options.

Impact

Agent skill configuration may be added during project creation; this is a guarded extension-lifecycle capability.

Mechanism

The CLI defaults skills on and invokes an npx skills add command with detected agent targets.

AI rationale

The automatic agent-skill installation is a real first-party agent extension lifecycle risk, though it is reached through an explicit CLI command and no concrete malicious behavior was found.

Decision evidence

public snapshot

AI called this Suspicious at 85.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The manifest exposes a user-invoked CLI entry point.
The create command enables skills by default and runs an npx command to add Mastra skills for detected coding agents.
Credential handling stores Mastra credentials locally and verifies tokens against the configured Mastra platform API.

Evidence against

No npm preinstall, install, or postinstall hook is declared.
No confirmed credential exfiltration, destructive action, or foreign agent-control write was identified.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 757 KB of source, external domains: app.posthog.com, eu-assets.i.posthog.com, eu.i.posthog.com, gateway-api.mastra.ai, gateway-api.staging.mastra.ai, github.com, mastra.ai, platform.mastra.ai, posthog.com, projects.mastra.ai, raw.githubusercontent.com, sentry.io, studio.mastra.ai, studio.staging.mastra.ai, us-assets.i.posthog.com, us.i.posthog.com, us.posthog.com, yandex.com

Source & flagged code

8 flagged

dist/credentials-Cgc5DcYQ-Cfe8N7V8.jsView file

Lines 1-33javascript

1import { t as MASTRA_PLATFORM_API_URL } from "./client-CdJ_HgDO-BKCiJhNz.js";

2import { createRequire } from "node:module";

3import "node:path";

4import process$1, { stdin, stdout } from "node:process";

5import { randomBytes } from "crypto";

6import { readFileSync as readFileSync$1 } from "fs";

7import { homedir, release } from "os";

8import { join } from "path";

9import { chmod, mkdir, readFile, writeFile } from "fs/promises";

10import { styleText } from "node:util";

11import * as l from "node:readline";

12import l__default from "node:readline";

13import { ReadStream } from "node:tty";

14import { execFileSync } from "child_process";

15import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/credentials-Cgc5DcYQ-Cfe8N7V8.jsView on unpkg · L13

16//#region \0rolldown/runtime.js

17var __create = Object.create;

18var __defProp = Object.defineProperty;

19var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

20var __getOwnPropNames = Object.getOwnPropertyNames;

21var __getProtoOf = Object.getPrototypeOf;

22var __hasOwnProp = Object.prototype.hasOwnProperty;

23var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);

24var __copyProps = (to, from, except, desc) => {

25 if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i <

26 key = keys[i];

27 if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {

28 get: ((k) => from[k]).bind(null, key),

29 enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable

30 });

31 }

32 return to;

33};

dist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1View file

294if (!inSurrogate) { L295: inSurrogate = character >= "\ud800" && character <= "\udbff";\n\t\t\tif (inSurrogate) continue;\n\t\t} else inSurrogate = false;\n\t\tif (character === ESC || character === CSI) {\... L296: return (await login(signal, options)).token;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1View on unpkg · L294

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1View on unpkg · L294

294Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js -> dist/credentials-Cgc5DcYQ-Cfe8N7V8.js L294: if (!inSurrogate) { L295: inSurrogate = character >= "\ud800" && character <= "\udbff";\n\t\t\tif (inSurrogate) continue;\n\t\t} else inSurrogate = false;\n\t\tif (character === ESC || character === CSI) {\... L296: return (await login(signal, options)).token;

dist/index.jsView file

5import { EventEmitter, addAbortListener, on, once, setMaxListeners } from "node:events"; L6: import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process"; L7: import path, { basename, delimiter, dirname, isAbsolute, normalize, resolve } from "node:path"; ... L36: * Constructs the CommanderError class L37: * @param {number} exitCode suggested exit code which could be used with process.exit L38: * @param {string} code an id string representing the error ... L182: * @return {string} L183: * @private L184: */ ... L197: * TypeScript import types for JSDoc, used by Visual Studio Code IntelliSense and `npm run typescript-checkJS` L198: * https://www.typescriptlang.org/docs/handbook/jsdoc-supported-types.html#import-types L199: * @typedef { import("./argument.js").Argument } A

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg · L5

5Trigger-reachable chain: manifest.main -> dist/index.js L5: import { EventEmitter, addAbortListener, on, once, setMaxListeners } from "node:events"; L6: import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process"; L7: import path, { basename, delimiter, dirname, isAbsolute, normalize, resolve } from "node:path"; ... L36: * Constructs the CommanderError class L37: * @param {number} exitCode suggested exit code which could be used with process.exit L38: * @param {string} code an id string representing the error ... L182: * @return {string} L183: * @private L184: */ ... L197: * TypeScript import types for JSDoc, used by Visual Studio Code IntelliSense and `npm run typescript-checkJS` L198: * https://www.typescriptlang.org/docs/handbook/jsdoc-supported-types.html#import-types

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L5

Source & flagged code

8 flagged · loading source

dist/credentials-Cgc5DcYQ-Cfe8N7V8.jsView file

13import { ReadStream } from "node:tty"; L14: import { execFileSync } from "child_process"; L15: import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/credentials-Cgc5DcYQ-Cfe8N7V8.jsView on unpkg · L13

dist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1View on unpkg · L294

Findings

2 Critical6 High3 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processdist/credentials-Cgc5DcYQ-Cfe8N7V8.js

HighSame File Env Network Executiondist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1

HighCommand Output Exfiltrationdist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1

HighSandbox Evasion Gated Capabilitydist/index.js

HighTrigger Reachable Command Output Exfiltrationdist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1

HighSemantic Analysis Limiteddist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to create-mastra@1.31.1.

See all versions of create-mastra for other recorded verdicts.

Review the evidence and your use of create-mastra@1.31.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-28 04:39:08.870Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code