registry / mastra / 1.20.3

mastra@1.20.3

cli for mastra

AI Security Review

scanned 23d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The CLI performs project scaffolding, deployment, and optional MCP configuration only when its commands are invoked; global MCP configuration has an explicit confirmation.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User invokes mastra CLI commands, particularly init/create/deploy.

Impact

May create or modify the selected project and, with explicit confirmation, selected editor MCP configuration; no install-time execution or covert exfiltration found.

Mechanism

User-directed project setup, platform API access, optional telemetry, and optional MCP registration.

Rationale

Direct inspection found a normal user-invoked CLI, no lifecycle hooks, and no concrete malicious chain. Scanner signals correspond to declared CLI functionality; MCP configuration mutation is explicit and globally scoped only after confirmation.

Evidence

package.jsondist/index.jsdist/create-CaJZFOGC.jsdist/analytics-Cz1-gjQi.jsdist/orgs-DoKnmO72.js~/.mastra/credentials.json~/.cursor/mcp.json~/.codeium/windsurf/mcp_config.json~/.gemini/antigravity/mcp_config.json<project>/.cursor/mcp.json<project>/.vscode/mcp.json

Network endpoints3

platform.mastra.aius.posthog.commastra.ai/api/templates.json

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall lifecycle hook.
dist/index.js only runs CLI parsing after direct user invocation.
dist/analytics-Cz1-gjQi.js gates MCP setup behind init --mcp or an interactive choice.
Global MCP writes require an explicit confirmation naming the target config.
dist/create-CaJZFOGC.js runs git/npx/package-manager commands only during create/init workflows.
Telemetry is opt-out via MASTRA_TELEMETRY_DISABLED, with a documented PostHog host.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

7 flagged

dist/studio/assets/livekit-client.esm-CKIgC2IJ.jsView file

13patternName = generic_password severity = medium line = 13 matchedText = `},e.par...+`\r

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/studio/assets/livekit-client.esm-CKIgC2IJ.jsView on unpkg · L13

dist/studio/assets/engine-compile-BkERmzkH.jsView file

Lines 1-21javascript

1const de=String.raw,Ee=de`(?:\p{Emoji}\uFE0F\u20E3?|\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|\p{Emoji_Presentation})`,ve=de`\u{E0061}-\u{E007A}`,dt=()=>new RegExp(de`[\u{1F1E6}-\u{1F1FF}]{2}|\u{1F3F4}[${ve}]{2}[\u{E0030}-\u{E0039}${ve}]{1,3}\u{E007F}|${Ee}(?:\u200D${Ee})*`,"gu"),x=Object.freeze({DEFAULT:"DEFAULT",CHAR_CLASS:"CHAR_CLASS"});function K(e,t,r,s){const n=new RegExp(String.raw`${t}|(?<$skip>\[\^?|\\?.)`,"gsu"),a=[!1];let i=0,o="";for(const c of e.matchAll(n)){const{0:u,groups:{$skip:l}}=c;if(!l&&(!s||s===x.DEFAULT==!i)){r instanceof Function?o+=r(c,{context:i?x.CHAR_CLASS:x.DEFAUL ...

2\\(?: \d+

High

Child Process

Package source references child process execution.

dist/studio/assets/engine-compile-BkERmzkH.jsView on unpkg · L1

3 | c[A-Za-z]

4 | [gk]<[^>]+>

5 | [pPu]\{[^\}]+\}

6 | u[A-Fa-f\d]{4}

7 | x[A-Fa-f\d]{2}

8 )

9| \((?: \? (?: [:=!>]

10 | <(?:[=!]|[^>]+>)

11 | [A-Za-z\-]+:

12 | $DEFINE$

13 ))?

14| (?<qBase>${Oe})(?<qMod>[?+]?)(?<invalidQ>[?*+\{]?)

15| \\?.

16`.replace(/\s+/g,""),"gsu");function vt(e){if(!new RegExp(`${Oe}\\+`).test(e))return e;const t=[];let r=null,s=null,n="",a=0,i;for(re.lastIndex=0;i=re.exec(e);){const{0:o,index:c,groups:{qBase:u,qMod:l,invalidQ:f}}=i;if(o==="[")a||(s=c),a++;else if(o==="]")a?a--:s=null;else if(!a)if(l==="+"&&n&&!n.startsWith("(")){if(f)throw new Error(`Invalid quantifier "${o}"`);let m=-1;if(/^\{\d+\}$/.test(u))e=yt(e,c+u.length,l,"");else{if(n===")"||n==="]"){const g=n===")"?r:s;if(g===null)throw new Error(`Invalid unmatched "${n}"`);e=`${e.slice(0,g)}(?>${e.slice(g,c)}${u})${e.slice(c+o.length)}`}else e=`${e ...

17Cc Control cntrl

18Cf Format

19Cn Unassigned

20Co Private_Use

21Cs Surrogate

Long lines were clipped for display.

dist/create-CaJZFOGC.jsView file

Lines 1-27javascript

1import { o as LoginCancelledError, r as resolveCurrentOrg, t as OrgSelectionCancelledError, u as getToken } from "./orgs-DoKnmO72.js";

2import { B as validateProjectName, F as normalizeCreateCommandOptions, M as CREATE_LLM_PROVIDERS, O as writeObservabilityEnv, a as getPackageManager, c

dist/studio/assets/tsx-B6W0miNI.jsView file

Lines 1-2javascript

1const e=Object.freeze(JSON.parse(`{"displayName":"TSX","name":"tsx","patterns":[{"include":"#directives"},{"include":"#statements"},{"include":"#shebang"}],"repository":{"access-modifier":{"match":"(?<![_$[:alnum:]])(?:(?<=\\\\.\\\\.\\\\.)|(?<!\\\\.))(abstract|declare|override|public|protected|private|readonly|static)(?![_$[:alnum:]])(?:(?=\\\\.\\\\.\\\\.)|(?!

dist/studio/assets/main-n0iDoxTR.jsView file

•path = dist/studio/assets/main-n0iDoxTR.js kind = oversized_source_file sizeBytes = 6952139 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/studio/assets/main-n0iDoxTR.jsView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = mastra@1.18.1 matchedIdentity = npm:bWFzdHJh:1.18.1 similarity = 0.697 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/studio/assets/livekit-client.esm-CKIgC2IJ.jsView file

13patternName = generic_password severity = medium line = 13 matchedText = `},e.par...+`\r

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/studio/assets/livekit-client.esm-CKIgC2IJ.jsView on unpkg · L13

dist/studio/assets/engine-compile-BkERmzkH.jsView file

1const de=String.raw,Ee=de`(?:\p{Emoji}\uFE0F\u20E3?|\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|\p{Emoji_Presentation})`,ve=de`\u{E0061}-\u{E007A}`,dt=()=>new RegExp(de`[\u{1F1E6}-\... L2: \\(?: \d+

High

Child Process

Package source references child process execution.

dist/studio/assets/engine-compile-BkERmzkH.jsView on unpkg · L1

dist/create-CaJZFOGC.jsView file

Findings

4 High7 Medium6 Low

HighChild Processdist/studio/assets/engine-compile-BkERmzkH.js

HighShelldist/create-CaJZFOGC.js

HighSame File Env Network Executiondist/create-CaJZFOGC.js

HighPrevious Version Dangerous Deltadist/index.js

MediumSecret Patterndist/studio/assets/livekit-client.esm-CKIgC2IJ.js

MediumDynamic Requiredist/studio/assets/tsx-B6W0miNI.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumOversized Source Filedist/studio/assets/main-n0iDoxTR.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated