registry / mastra / 1.16.0

mastra@1.16.0

cli for mastra

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 32 file(s), 2.41 MB of source, external domains: api.open-meteo.com, app.posthog.com, gateway-api.mastra.ai, gateway-api.staging.mastra.ai, geocoding-api.open-meteo.com, github.com, mastra.ai, observability.mastra.ai, platform.mastra.ai, prettier.io, projects.mastra.ai, raw.githubusercontent.com, react.dev, skills.sh, studio.mastra.ai, studio.staging.mastra.ai, us.posthog.com

Oversized source lightweight scan

dist/studio/assets/main-04biggqk.js6.48 MB file, sampled 256 KB

HighEntropyStringsMinifiedUrlStringsgithub.commastra.aireact.devskills.sh

Source & flagged code

6 flagged

dist/studio/assets/engine-compile-BkERmzkH.jsView file

Lines 1-21javascript

1const de=String.raw,Ee=de`(?:\p{Emoji}\uFE0F\u20E3?|\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|\p{Emoji_Presentation})`,ve=de`\u{E0061}-\u{E007A}`,dt=()=>new RegExp(de`[\u{1F1E6}-\u{1F1FF}]{2}|\u{1F3F4}[${ve}]{2}[\u{E0030}-\u{E0039}${ve}]{1,3}\u{E007F}|${Ee}(?:\u200D${Ee})*`,"gu"),x=Object.freeze({DEFAULT:"DEFAULT",CHAR_CLASS:"CHAR_CLASS"});function K(e,t,r,s){const n=new RegExp(String.raw`${t}|(?<$skip>\[\^?|\\?.)`,"gsu"),a=[!1];let i=0,o="";for(const c of e.matchAll(n)){const{0:u,groups:{$skip:l}}=c;if(!l&&(!s||s===x.DEFAULT==!i)){r instanceof Function?o+=r(c,{context:i?x.CHAR_CLASS:x.DEFAUL ...

2\\(?: \d+

High

Child Process

Package source references child process execution.

dist/studio/assets/engine-compile-BkERmzkH.jsView on unpkg · L1

3 | c[A-Za-z]

4 | [gk]<[^>]+>

5 | [pPu]\{[^\}]+\}

6 | u[A-Fa-f\d]{4}

7 | x[A-Fa-f\d]{2}

8 )

9| \((?: \? (?: [:=!>]

10 | <(?:[=!]|[^>]+>)

11 | [A-Za-z\-]+:

12 | $DEFINE$

13 ))?

14| (?<qBase>${Oe})(?<qMod>[?+]?)(?<invalidQ>[?*+\{]?)

15| \\?.

16`.replace(/\s+/g,""),"gsu");function vt(e){if(!new RegExp(`${Oe}\\+`).test(e))return e;const t=[];let r=null,s=null,n="",a=0,i;for(re.lastIndex=0;i=re.exec(e);){const{0:o,index:c,groups:{qBase:u,qMod:l,invalidQ:f}}=i;if(o==="[")a||(s=c),a++;else if(o==="]")a?a--:s=null;else if(!a)if(l==="+"&&n&&!n.startsWith("(")){if(f)throw new Error(`Invalid quantifier "${o}"`);let m=-1;if(/^\{\d+\}$/.test(u))e=yt(e,c+u.length,l,"");else{if(n===")"||n==="]"){const g=n===")"?r:s;if(g===null)throw new Error(`Invalid unmatched "${n}"`);e=`${e.slice(0,g)}(?>${e.slice(g,c)}${u})${e.slice(c+o.length)}`}else e=`${e ...

17Cc Control cntrl

18Cf Format

19Cn Unassigned

20Co Private_Use

21Cs Surrogate

Long lines were clipped for display.

dist/chunk-B373URKY.jsView file

Lines 1-33javascript

1import { createMastraDir, writeIndexFile, createComponentsDir, writeAPIKey, writeCodeSample, DepsService, getAPIKey, installMastraDocsMCPServer, writeAgentsMarkdown, writeClaudeMarkdown, gitInit, readPackageName, writeObservabilityEnv, getAnalytics, getPackageManager, LLM_PROVIDERS, resolveCurrentOrg, isGitInitialized, interactivePrompt, getPackageManagerAddCommand, getModelIdentifier } from './chunk-NGAJT6UU.js';

2import { getToken } from './chunk-EXG3XKBK.js';

3import { MASTRA_PLATFORM_API_URL, platformFetch, authHeaders } from './chunk-L2SGSIJI.js';

4import fsSync from 'fs';

5import fs

dist/studio/assets/babel-CmeIX3PZ.jsView file

Lines 1-16javascript

1var ns=Object.defineProperty,Fe=(t,e)=>{for(var s in e)ns(t,s,{get:e[s],enumerable:!0})},os={};Fe(os,{parsers:()=>aa});var wt={};Fe(wt,{__babel_estree:()=>

dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2View file

•path = dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2 kind = high_entropy_blob sizeBytes = 68648 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2View on unpkg

dist/studio/assets/main-04biggqk.jsView file

•path = dist/studio/assets/main-04biggqk.js kind = oversized_source_file sizeBytes = 6798751 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/studio/assets/main-04biggqk.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/studio/assets/engine-compile-BkERmzkH.jsView file

1const de=String.raw,Ee=de`(?:\p{Emoji}\uFE0F\u20E3?|\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|\p{Emoji_Presentation})`,ve=de`\u{E0061}-\u{E007A}`,dt=()=>new RegExp(de`[\u{1F1E6}-\... L2: \\(?: \d+

High

Child Process

Package source references child process execution.

dist/studio/assets/engine-compile-BkERmzkH.jsView on unpkg · L1

dist/chunk-B373URKY.jsView file

13import { PinoLogger } from '@mastra/loggers'; L14: import { execa } from 'execa'; L15:

High

Shell

Package source references shell execution.

dist/chunk-B373URKY.jsView on unpkg · L13

245const installCommand = shellQuote.quote([pm, "install"]); L246: await exec(installCommand, { L247: cwd: projectPath ... L254: } L255: var TEMPLATES_API_URL = process.env.MASTRA_TEMPLATES_API_URL || "https://mastra.ai/api/templates.json"; L256: async function loadTemplates() {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunk-B373URKY.jsView on unpkg · L245

dist/studio/assets/babel-CmeIX3PZ.jsView file

2- Did you mean \`export { '${t}' as '${e}' } from 'some-module'\`?`,ExportDefaultFromAsIdentifier:"'from' is not allowed as an identifier after 'export default'.",ForInOfLoopInitia... L3: - Did you mean \`import { "${t}" as foo }\`?`,ImportCallArity:"`import()` requires exactly one or two arguments.",ImportCallNotNewExpression:"Cannot use new with import(...).",Impo... L4: `:`\r

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/studio/assets/babel-CmeIX3PZ.jsView on unpkg · L2

dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2View file

•path = dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2 kind = high_entropy_blob sizeBytes = 68648 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2View on unpkg

dist/studio/assets/main-04biggqk.jsView file

•path = dist/studio/assets/main-04biggqk.js kind = oversized_source_file sizeBytes = 6798751 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/studio/assets/main-04biggqk.jsView on unpkg

Findings

5 High4 Medium6 Low

HighChild Processdist/studio/assets/engine-compile-BkERmzkH.js

HighShelldist/chunk-B373URKY.js

HighSame File Env Network Executiondist/chunk-B373URKY.js

HighShips High Entropy Blobdist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2

HighOversized Source Filedist/studio/assets/main-04biggqk.js

MediumDynamic Requiredist/studio/assets/babel-CmeIX3PZ.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

6 flagged

dist/studio/assets/engine-compile-BkERmzkH.jsView file

Lines 1-21javascript

2\\(?: \d+

High

Child Process

Package source references child process execution.

dist/studio/assets/engine-compile-BkERmzkH.jsView on unpkg · L1

3 | c[A-Za-z]

4 | [gk]<[^>]+>

5 | [pPu]\{[^\}]+\}

6 | u[A-Fa-f\d]{4}

7 | x[A-Fa-f\d]{2}

8 )

9| \((?: \? (?: [:=!>]

10 | <(?:[=!]|[^>]+>)

11 | [A-Za-z\-]+:

12 | $DEFINE$

13 ))?

14| (?<qBase>${Oe})(?<qMod>[?+]?)(?<invalidQ>[?*+\{]?)

15| \\?.

17Cc Control cntrl

18Cf Format

19Cn Unassigned

20Co Private_Use

21Cs Surrogate

Long lines were clipped for display.

dist/chunk-B373URKY.jsView file

Lines 1-33javascript

2import { getToken } from './chunk-EXG3XKBK.js';

3import { MASTRA_PLATFORM_API_URL, platformFetch, authHeaders } from './chunk-L2SGSIJI.js';

4import fsSync from 'fs';

5import fs

dist/studio/assets/babel-CmeIX3PZ.jsView file

Lines 1-16javascript

1var ns=Object.defineProperty,Fe=(t,e)=>{for(var s in e)ns(t,s,{get:e[s],enumerable:!0})},os={};Fe(os,{parsers:()=>aa});var wt={};Fe(wt,{__babel_estree:()=>

dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2View file

•path = dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2 kind = high_entropy_blob sizeBytes = 68648 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/studio/assets/CommitMono-700-Regular-DmOSN4kd.woff2View on unpkg

dist/studio/assets/main-04biggqk.jsView file

•path = dist/studio/assets/main-04biggqk.js kind = oversized_source_file sizeBytes = 6798751 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/studio/assets/main-04biggqk.jsView on unpkg

Lines 225-265javascript

225async function updateEnvFile(envPath, llmProvider) {

226 try {

227 const envContent = await fs.readFile(envPath, "utf-8");

228 const modelString = getModelIdentifier(llmProvider);

229 if (!modelString) {

230 logger.warn("Could not get model identifier for provider", { provider: llmProvider });

231 return;

232 }

233 const modelValue = modelString.replace(/'/g, "");

234 const updatedContent = envContent.replace(/^MODEL=.*/m, `MODEL=${modelValue}`);

235 await fs.writeFile(envPath, updatedContent, "utf-8");

236 logger.info("Updated MODEL in .env", { model: modelValue });

237 } catch (error) {

238 logger.warn("Could not update .env file", { error: error instanceof Error ? error.message : "Unknown error" });

239 }

240}

241async function installDependencies(projectPath, packageManager) {

242 const spinner4 = yoctoSpinner({ text: "Installing dependencies..." }).start();

243 try {

244 const pm = packageManager || getPackageManager();

245 const installCommand = shellQuote.quote([pm, "install"]);

246 await exec(installCommand, {

247 cwd: projectPath

248 });

249 spinner4.success("Dependencies installed successfully");

250 } catch (error) {

251 spinner4.error(`Failed to install dependencies: ${error instanceof Error ? error.message : "Unknown error"}`);

252 throw error;

253 }

254}

255var TEMPLATES_API_URL = process.env.MASTRA_TEMPLATES_API_URL || "https://mastra.ai/api/templates.json";

256async function loadTemplates() {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunk-B373URKY.jsView on unpkg · L245

257 try {

258 const response = await fetch(TEMPLATES_API_URL);

259 if (!response.ok) {

260 throw new Error(`Failed to fetch templates: ${response.statusText}`);

261 }

262 const templates = await response.json();

263 return templates;

264 } catch (error) {

265 console.error("Error loading templates:", error);