create-mastra@1.31.3

Create Mastra apps with one command

AI Security Review

scanned 26d ago · by lpm-firewall-ai

create-mastra 1.31.3 is a user-invoked project scaffolder with no npm lifecycle hooks, and the flagged editor MCP path joins are unused expression statements. Login and analytics stay on package-aligned Mastra and PostHog endpoints and are not an install-time attack.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User execution of the create-mastra binary.

Impact

No unconsented agent-control mutation, credential theft, or install hook was established.

Mechanism

The command scaffolds a project and may verify a login token against the Mastra platform auth API. Unused editor MCP path expressions are evaluated and discarded.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes a create-mastra bin at dist/index.js and its scripts are only build, lint, and test, with no preinstall, install, or postinstall hook.
Editor MCP path joins around the flagged location in dist/index.js are discarded expression statements and are not passed to a file write.
Login token checks call the Mastra platform auth verify endpoint with a bearer token from that same login flow.
The bundled CLI runs its create action only after the user invokes the binary and commander parses process.argv.

Evidence against

Default CLI telemetry can send host and version fields to PostHog unless MASTRA_TELEMETRY_DISABLED is set.
MASTRA_PLATFORM_API_URL can override the platform host, but the token is obtained from that same login flow rather than copied from another service.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

Source & flagged code

8 flagged

dist/credentials-Cgc5DcYQ-Cfe8N7V8.jsView file

Lines 1-33javascript

1import { t as MASTRA_PLATFORM_API_URL } from "./client-CdJ_HgDO-BKCiJhNz.js";

2import { createRequire } from "node:module";

3import "node:path";

4import process$1, { stdin, stdout } from "node:process";

5import { randomBytes } from "crypto";

6import { readFileSync as readFileSync$1 } from "fs";

7import { homedir, release } from "os";

8import { join } from "path";

9import { chmod, mkdir, readFile, writeFile } from "fs/promises";

10import { styleText } from "node:util";

11import * as l from "node:readline";

12import l__default from "node:readline";

13import { ReadStream } from "node:tty";

14import { execFileSync } from "child_process";

15import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/credentials-Cgc5DcYQ-Cfe8N7V8.jsView on unpkg · L13

16//#region \0rolldown/runtime.js

17var __create = Object.create;

18var __defProp = Object.defineProperty;

19var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

20var __getOwnPropNames = Object.getOwnPropertyNames;

21var __getProtoOf = Object.getPrototypeOf;

22var __hasOwnProp = Object.prototype.hasOwnProperty;

23var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);

24var __copyProps = (to, from, except, desc) => {

25 if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i <

26 key = keys[i];

27 if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {

28 get: ((k) => from[k]).bind(null, key),

29 enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable

30 });

31 }

32 return to;

33};

dist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1View file

294if (!inSurrogate) { L295: inSurrogate = character >= "\ud800" && character <= "\udbff";\n\t\t\tif (inSurrogate) continue;\n\t\t} else inSurrogate = false;\n\t\tif (character === ESC || character === CSI) {\... L296: return (await login(signal, options)).token;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1View on unpkg · L294

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1View on unpkg · L294

294Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js -> dist/credentials-Cgc5DcYQ-Cfe8N7V8.js L294: if (!inSurrogate) { L295: inSurrogate = character >= "\ud800" && character <= "\udbff";\n\t\t\tif (inSurrogate) continue;\n\t\t} else inSurrogate = false;\n\t\tif (character === ESC || character === CSI) {\... L296: return (await login(signal, options)).token;

dist/index.jsView file

5import { EventEmitter, addAbortListener, on, once, setMaxListeners } from "node:events"; L6: import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process"; L7: import path, { basename, delimiter, dirname, isAbsolute, normalize, resolve } from "node:path"; ... L36: * Constructs the CommanderError class L37: * @param {number} exitCode suggested exit code which could be used with process.exit L38: * @param {string} code an id string representing the error ... L182: * @return {string} L183: * @private L184: */ ... L197: * TypeScript import types for JSDoc, used by Visual Studio Code IntelliSense and `npm run typescript-checkJS` L198: * https://www.typescriptlang.org/docs/handbook/jsdoc-supported-types.html#import-types L199: * @typedef { import("./argument.js").Argument } A

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg · L5

5Trigger-reachable chain: manifest.main -> dist/index.js L5: import { EventEmitter, addAbortListener, on, once, setMaxListeners } from "node:events"; L6: import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process"; L7: import path, { basename, delimiter, dirname, isAbsolute, normalize, resolve } from "node:path"; ... L36: * Constructs the CommanderError class L37: * @param {number} exitCode suggested exit code which could be used with process.exit L38: * @param {string} code an id string representing the error ... L182: * @return {string} L183: * @private L184: */ ... L197: * TypeScript import types for JSDoc, used by Visual Studio Code IntelliSense and `npm run typescript-checkJS` L198: * https://www.typescriptlang.org/docs/handbook/jsdoc-supported-types.html#import-types

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L5

Source & flagged code

8 flagged · loading source

dist/credentials-Cgc5DcYQ-Cfe8N7V8.jsView file

13import { ReadStream } from "node:tty"; L14: import { execFileSync } from "child_process"; L15: import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/credentials-Cgc5DcYQ-Cfe8N7V8.jsView on unpkg · L13

dist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1View on unpkg · L294

Findings

2 Critical6 High3 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processdist/credentials-Cgc5DcYQ-Cfe8N7V8.js

HighSame File Env Network Executiondist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1

HighCommand Output Exfiltrationdist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1

HighSandbox Evasion Gated Capabilitydist/index.js

HighTrigger Reachable Command Output Exfiltrationdist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1

HighSemantic Analysis Limiteddist/credentials-Cgc5DcYQ-Cfe8N7V8.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to create-mastra@1.31.3.

See all versions of create-mastra for other recorded verdicts.

Review the evidence and your use of create-mastra@1.31.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-27 15:50:11.584Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.