mastra@1.22.0: Clean npm security report (Allow) | LPM Firewall
Passed — safe to install
No malicious behavior detected. 18 low-signal pattern(s) reviewed.
mastra@1.22.0 cli for mastra
scanned 12d ago · by lpm-firewall-ai No confirmed malicious attack surface. Network and filesystem operations are tied to user-invoked CLI commands, telemetry, authentication, deployment, or explicit MCP setup.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs the mastra CLI; MCP mutation requires `mastra init --mcp <editor>` or interactive selection.
Impact
May send CLI telemetry and perform requested project, credential, deployment, or MCP configuration actions.
Mechanism
CLI telemetry, platform API access, and explicit project/editor setup.
Rationale
The flagged primitives are expected functions of a Mastra CLI and are activated by explicit user commands. No install-time execution, covert payload, credential harvesting, or unconsented control-surface mutation was found.
Evidence
package.json dist/index.js dist/analytics-CzFlN5Uy.js dist/client-x6vJatG_.js dist/credentials-CE1thn6C.js dist/create-DxtDgme6.js ~/.mastra/analytics.json ~/.mastra/credentials.json .cursor/mcp.json .vscode/mcp.json
Network endpoints4
us.posthog.com platform.mastra.ai gateway-api.mastra.ai /v1studio.mastra.ai
public snapshot AI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for block
Default CLI telemetry sends hostname and runtime metadata to PostHog. `init --mcp` can write selected editor MCP configuration. Evidence against
package.json has no preinstall/install/postinstall hooks. Entry point is a user-invoked CLI bin. MCP writes require explicit `--mcp` or interactive confirmation. MCP config starts the named @mastra docs server, not a hidden payload. Platform/auth requests are command-scoped Mastra API operations. No source evidence of secret harvesting or unconsented exfiltration. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Filesystem Network Shell WebSocket
Supply chain HighEntropyStrings Minified Obfuscated Protestware Telemetry UrlStrings
Manifest
8 flagged · loading source dist/studio/assets/livekit-client.esm-CKIgC2IJ.js View file 13 patternName = generic_password
severity = medium
line = 13
matchedText = `},e.par...+`\r
Medium Secret Pattern
Package contains a possible secret pattern.
dist/studio/assets/livekit-client.esm-CKIgC2IJ.js View on unpkg · L13 dist/studio/assets/engine-compile-BkERmzkH.js View file 1 const de=String.raw,Ee=de`(?:\p{Emoji}\uFE0F\u20E3?|\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|\p{Emoji_Presentation})`,ve=de`\u{E0061}-\u{E007A}`,dt=()=>new RegExp(de`[\u{1F1E6}-\...
L2: \\(?: \d+
High Child Process
Package source references child process execution.
dist/studio/assets/engine-compile-BkERmzkH.js View on unpkg · L1 2 Critical 3 High 7 Medium 6 Low
Critical Hardcoded Runtime Data Exfiltration dist/analytics-CzFlN5Uy.js
Critical Trigger Reachable Dangerous Capability dist/analytics-CzFlN5Uy.js
High Child Process dist/studio/assets/engine-compile-BkERmzkH.js
High Shell dist/index.js
High Same File Env Network Execution dist/create-DxtDgme6.js
Medium Secret Pattern dist/studio/assets/livekit-client.esm-CKIgC2IJ.js
Medium Dynamic Require dist/studio/assets/tsx-B6W0miNI.js
Medium Network
Medium Environment Vars
Medium Protestware
Medium Oversized Source File dist/studio/assets/main-BiFSrjyM.js
Medium Structural Risk Force Deep Review
No manifest risk signals triggered.
scanned 40 file(s), 3.30 MB of source, external domains: aomediacodec.github.io, api.open-meteo.com, app.posthog.com, base-ui.com, cloud-api.livekit.io, gateway-api.mastra.ai, gateway-api.staging.mastra.ai, geocoding-api.open-meteo.com, github.com, mastra.ai, observability.mastra.ai, output.signals.mastra.ai, platform.mastra.ai, prettier.io, projects.mastra.ai, raw.githubusercontent.com, react.dev, studio.mastra.ai, studio.staging.mastra.ai, us.posthog.com, www.w3.org
Oversized source lightweight scan
dist/factory/assets/index-BjvuwnI8.js 3.61 MB file, sampled 256 KB
Network ChildProcess HighEntropyStrings Minified UrlStrings base-ui.com react.dev www.w3.org
dist/studio/assets/main-BiFSrjyM.js 6.65 MB file, sampled 256 KB
HighEntropyStrings Minified UrlStrings mastra.ai react.dev
18 import { fileURLToPath } from "url";
L19: import { execa } from "execa";
L20: import * as fsExtra$1 from "fs-extra";
1 const e=Object.freeze(JSON.parse(`{"displayName":"TSX","name":"tsx","patterns":[{"include":"#directives"},{"include":"#statements"},{"include":"#shebang"}],"repository":{"access-mo...
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/studio/assets/tsx-B6W0miNI.js View on unpkg · L1 117 try {
L118: await execa(packageManager || getPackageManager(), ["install"], {
L119: cwd: projectPath,
...
L131: //#region src/utils/template-utils.ts
L132: const TEMPLATES_API_URL = process.env.MASTRA_TEMPLATES_API_URL || "https://mastra.ai/api/templates.json";
L133: async function loadTemplates() {
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/create-DxtDgme6.js View on unpkg · L117 12 import { fileURLToPath } from "url";
L13: import { execa } from "execa";
L14: import fsExtra from "fs-extra";
...
L109: const args = createArgs(versionTag);
L110: if (editor === "vscode") return { servers: { mastra: process.platform === `win32` ? {
L111: command: "cmd",
...
L148: }
L149: const windsurfGlobalMCPConfigPath = path.join(os.homedir(), ".codeium", "windsurf", "mcp_config.json");
L150: const antigravityGlobalMCPConfigPath = path.join(os.homedir(), ".gemini", "antigravity", "mcp_config.json");
...
L224: "pnpm-lock.yaml",
L225: "package-lock.json",
L226: "yarn.lock",
Critical Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/analytics-CzFlN5Uy.js View on unpkg · L12 12 Trigger-reachable chain: manifest.main -> dist/index.js -> dist/analytics-CzFlN5Uy.js
L12: import { fileURLToPath } from "url";
L13: import { execa } from "execa";
L14: import fsExtra from "fs-extra";
...
L109: const args = createArgs(versionTag);
L110: if (editor === "vscode") return { servers: { mastra: process.platform === `win32` ? {
L111: command: "cmd",
...
L148: }
L149: const windsurfGlobalMCPConfigPath = path.join(os.homedir(), ".codeium", "windsurf", "mcp_config.json");
L150: const antigravityGlobalMCPConfigPath = path.join(os.homedir(), ".gemini", "antigravity", "mcp_config.json");
...
L224: "pnpm-lock.yaml",
L225: "package-lock.json",
L226: "yarn.lock",
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/analytics-CzFlN5Uy.js View on unpkg · L12 • path = dist/studio/assets/main-BiFSrjyM.js
kind = oversized_source_file
sizeBytes = 6976006
magicHex = [redacted]
Medium Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/studio/assets/main-BiFSrjyM.js View on unpkg Low
Scripts Present
exports map
bin → mastra
Artifact 16.9 MB · 317 files 1 signature(s) · provenance
Install lifecycle No install hooks · other: build:lib, clean, generate:api-manifest, lint +4
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Filesystem Network Shell WebSocket HighEntropyStrings Minified Obfuscated Protestware Telemetry UrlStrings Manifest: clean
LPM CLI
8 flagged dist/studio/assets/livekit-client.esm-CKIgC2IJ.js View file 13 patternName = generic_password
severity = medium
line = 13
matchedText = `},e.par...+`\r
Medium Secret Pattern
Package contains a possible secret pattern.
dist/studio/assets/livekit-client.esm-CKIgC2IJ.js View on unpkg · L13 dist/studio/assets/engine-compile-BkERmzkH.js View file Lines 1-21 javascript
1 const de = String.raw, Ee = de `(?: \p {Emoji} \uFE0F\u20E3 ?| \p {Emoji_Modifier_Base} \p {Emoji_Modifier}?| \p {Emoji_Presentation})` , ve = de ` \u{E0061} - \u{E007A} ` , dt = () =>new RegExp ( de `[ \u{1F1E6} - \u{1F1FF} ]{2}| \u{1F3F4} [${ ve }]{2}[ \u{E0030} - \u{E0039} ${ ve }]{1,3} \u{E007F} |${ Ee }(?: \u200D ${ Ee })*` , "gu" ), x = Object. freeze ({DEFAULT: "DEFAULT" ,CHAR_CLASS: "CHAR_CLASS" }); function K ( e , t , r , s ){ const n =new RegExp (String. raw `${ t }|(?<$skip> \[\^ ?| \\ ?.)` , "gsu" ), a = [ ! 1 ]; let i = 0 ,o = "" ; for ( const c of e. matchAll (n)){ const { 0 : u , groups :{ $skip : l }} = c; if ( ! l && ( ! s || s === x. DEFAULT ==! i)){r instanceof Function ? o += r (c,{context:i ? x. CHAR_CLASS : x. DEFAUL ...
2 \\( ?: \d +
High Child Process
Package source references child process execution.
dist/studio/assets/engine-compile-BkERmzkH.js View on unpkg · L1 14 | ( ? < qBase >${Oe})(?< qMod >[?+]?)(?< invalidQ >[?*+\{] ? )
16 `.replace(/ \s +/g,""),"gsu");function vt(e){if(!new RegExp(` ${Oe}\\ + `).test(e))return e;const t=[];let r=null,s=null,n="",a=0,i;for(re.lastIndex=0;i=re.exec(e);){const{0:o,index:c,groups:{qBase:u,qMod:l,invalidQ:f}}=i;if(o==="[")a||(s=c),a++;else if(o==="]")a?a--:s=null;else if(!a)if(l==="+"&&n&&!n.startsWith("(")){if(f)throw new Error(` Invalid quantifier "${o}"`);let m=-1;if(/^ \{\d + \} $/.test(u))e=yt(e,c+u.length,l,"");else{if(n===")"||n==="]"){const g=n===")"?r:s;if(g===null)throw new Error(` Invalid unmatched "${n}"`);e=` ${e.slice( 0 ,g)}( ?> ${e.slice(g,c)}${u})${e.slice(c+o.length)} `}else e=` ${e ...
Long lines were clipped for display.
Lines 1-38 javascript
2 import { A as DepsService, C as writeAPIKey, D as writeIndexFile, E as writeCodeSample, N as configureCreateCommand, O as writeObservabilityEnv, S as readPackageName, T as writeClaudeMarkdown, _ as checkForPkgJson, b as getAPIKey, c as isGitInitialized, d as
Lines 1-2 javascript
1 const e = Object. freeze ( JSON . parse ( `{"displayName":"TSX","name":"tsx","patterns":[{"include":"#directives"},{"include":"#statements"},{"include":"#shebang"}],"repository":{"access-modifier":{"match":"(?<![_$[:alnum:]])(?:(?<= \\\\ . \\\\ . \\\\ .)|(?<! \\\\ .))(abstract|declare|override|public|protected|private|readonly|static)(?![_$[:alnum:]])(?:(?= \\\\ . \\\\ . \\\\ .)|(?!
Lines 97-137 javascript
99 if (signal?.aborted) signal. throwIfAborted ();
100 throw new Error ( `Failed to clone repository: ${ gitError instanceof Error ?
Lines 1-32 javascript
1 import { a as loadCredentials, i as getToken } from "./credentials-CE1thn6C.js" ;
2 import { r as resolveCurrentOrg } from "./orgs-DOhO9kNz.js" ;
3 import { InvalidArgumentError } from "commander" ;
• path = dist/studio/assets/main-BiFSrjyM.js
kind = oversized_source_file
sizeBytes = 6976006
magicHex = [redacted]
Medium Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/studio/assets/main-BiFSrjyM.js View on unpkg parseMcp, f
as
shouldSkipDotenvLoading, g
as
checkAndInstallCoreDeps, h
as
LLMProvider, i
as
setAnalytics, j
as
installMastraDocsMCPServer, k
as
FileService$2, l
as
parseComponents, m
as
COMPONENTS, n
as
bucketApiHost, o
as
getVersionTag, p
as
wrapAction, r
as
getAnalytics, s
as
gitInit, t
as
PosthogAnalytics, u
as
parseLlmProvider, v
as
c ...
3 import { a as extractApiErrorDetail, c as throwApiError, i as createApiClient, n as MASTRA_STUDIO_URL, o as platformFetch, r as authHeaders, t as MASTRA_PLATFORM_API_URL } from "./client-x6vJatG_.js" ;
4 import { a as loadCredentials, d as verifyToken, i as getToken, l as tryRefreshToken, n as clearCredentials, o as login, r as getCurrentOrgId, u as validateOrgAccess } from "./credentials-CE1thn6C.js" ;
5 import { t as fetchOrgs } from "./api-DUOmLi5v.js" ;
6 import { i as switchOrgAction, n as listOrgsAction, r as resolveCurrentOrg } from "./orgs-DOhO9kNz.js" ;
7 import { a as runCreateCommand, c as createLogger, i as isCreateCancelledError, l as logger, n as create, o as installMastraSkills, r as getCreateCommandAnalyticsArgs, s as provisionObservabilityProject } from "./create-DxtDgme6.js" ;
8 import "./runtime-HAbtsZz-.js" ;
9 import { createRequire } from "module" ;
10 import { coreFeatures } from "@mastra/core/features" ;
11 import { Command } from "commander" ;
12 import color from "picocolors" ;
13 import { createHash, randomUUID } from "crypto" ;
14 import fs, { createWriteStream, existsSync, readFileSync, readdirSync, unlinkSync } from "fs" ;
15 import { tmpdir } from "os" ;
16 import path, { dirname, isAbsolute, join, posix, relative, resolve, sep } from "path" ;
17 import { access, chmod, mkdir, open, readFile, readdir, rm, stat, unlink, writeFile } from "fs/promises" ;
18 import { fileURLToPath } from "url" ;
19 import { execa } from "execa" ;
20 import * as fsExtra$1 from "fs-extra" ;
21 import { copy } from "fs-extra" ;
22 import * as p from "@clack/prompts" ;
23 import { execSync, spawn } from "child_process" ;
24 import http from "http" ;
25 import { FileService, getDeployer } from "@mastra/deployer" ;
26 import { FileService as FileService$1, analyzeEntryProjectType, createWatcher, discoverFsAgents, escapeStudioHtmlValue, getServerOptions, getWatcherInputOptions, mirrorFsAgentWorkspaces, normalizeStudioBase, prepareFsAgentsEntry, writeFsAgentsEntry } from "@mastra/deployer/build" ;
27 import { getPackageInfo } from "local-pkg" ;
28 import { gtr, satisfies, validRange } from "semver" ;
29 import { glob } from "tinyglobby" ;
30 import { Bundler, IS_DEFAULT } from "@mastra/deployer/bundler" ;
31 import { ZipArchive } from "archiver" ;
32 import { config, parse } from "dotenv" ;
33 import { parse as parse$1 } from "@babel/parser" ;
34 import * as t from "@babel/types" ;
35 import stripJsonComments from "strip-json-comments" ;
36 import process$1 from "process" ;
37 import devcert from "@expo/devcert" ;
38 import getPort from "get-port" ;
Long lines were clipped for display.
\\\\
.))","name":"storage.modifier.tsx"},"after-operator-block-as-object-literal":{"begin":"(?<!
\\\\
+
\\\\
+|--)(?<=[:=(,
\\\\
[?+!>]|^await|[^
\\\\
._$[:alnum:]]await|^return|[^
\\\\
._$[:alnum:]]return|^yield|[^
\\\\
._$[:alnum:]]yield|^throw|[^
\\
...
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/studio/assets/tsx-B6W0miNI.js View on unpkg · L1 Long lines were clipped for display.
gitError
.
message
:
"Unknown error"}`
);
104 async function updatePackageJson ( projectPath , projectName ) {
105 const packageJsonPath = path. join (projectPath, "package.json" );
107 const packageJsonContent = await fsPromises. readFile (packageJsonPath, "utf-8" );
108 const packageJson = JSON . parse (packageJsonContent);
109 packageJson.name = projectName;
110 await fsPromises. writeFile (packageJsonPath, JSON . stringify (packageJson, null , 2 ), "utf-8" );
112 logger. warn ( "Could not update package.json" , { error: error instanceof Error ? error.message : "Unknown error" });
115 async function installDependencies ( projectPath , packageManager , timeout , signal , silent = false ) {
116 const spinner = startSpinner ( "Installing dependencies..." , signal, silent);
118 await execa (packageManager || getPackageManager (), [ "install" ], {
121 killSignal: "SIGTERM" ,
122 ... signal ? { cancelSignal: signal } : {}
124 spinner?. success ( "Dependencies installed successfully" );
126 spinner?. error ( `Failed to install dependencies: ${ error instanceof Error ? error . message : "Unknown error"}` );
131 //#region src/utils/template-utils.ts
132 const TEMPLATES_API_URL = process.env. MASTRA_TEMPLATES_API_URL || "https://mastra.ai/api/templates.json" ;
133 async function loadTemplates () {
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/create-DxtDgme6.js View on unpkg · L117 135 const response = await fetch ( TEMPLATES_API_URL );
136 if ( ! response.ok) throw new Error ( `Failed to fetch templates: ${ response . statusText }` );
137 return await response. json ();
import color from "picocolors" ;
5 import { randomUUID } from "crypto" ;
6 import fs, { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs" ;
8 import path from "path" ;
9 import { PostHog } from "posthog-node" ;
10 import * as fs$1 from "fs/promises" ;
11 import fsPromises from "fs/promises" ;
12 import { fileURLToPath } from "url" ;
13 import { execa } from "execa" ;
14 import fsExtra from "fs-extra" ;
Critical Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/analytics-CzFlN5Uy.js View on unpkg · L12 Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/analytics-CzFlN5Uy.js View on unpkg · L12 15 import fsExtra$1, { ensureFile, readJSON, writeJSON } from "fs-extra/esm" ;
16 import * as p from "@clack/prompts" ;
17 import yoctoSpinner from "yocto-spinner" ;
18 //#region src/commands/create/command.ts
19 const CREATE_LLM_PROVIDERS = [