registry / mastra / 1.23.0

mastra@1.23.0

cli for mastra

AI Security Review

scanned 15d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The CLI performs package-aligned telemetry and authenticated platform operations only when its commands are invoked.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs the `mastra` CLI; deployments/authentication and MCP setup require their respective commands or options.

Impact

Telemetry may disclose CLI/system metadata to PostHog; explicit deployment commands upload selected build artifacts to Mastra services.

Mechanism

Opt-out CLI telemetry, explicit project/editor setup, and authenticated deployment APIs.

Rationale

Direct source inspection shows no install-time execution or concrete malicious chain. The flagged behaviors are documented CLI telemetry, explicit MCP setup, and authenticated Mastra deployment functionality.

Evidence

package.jsondist/index.jsdist/analytics-CzFlN5Uy.jsdist/client-x6vJatG_.jsdist/credentials-CE1thn6C.js

Network endpoints4

us.posthog.complatform.mastra.aigateway-api.mastra.ai/v1studio.mastra.ai

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

CLI telemetry is enabled by default and sends a generated ID, hostname, OS, Node version, and command metadata to PostHog.
`init --mcp` can write a Mastra MCP entry, including selected global editor configuration.

Evidence against

`package.json` has no preinstall/install/postinstall lifecycle hook.
Telemetry and config writes occur only after invoking the CLI; MCP setup requires the explicit `--mcp` option or interactive selection.
`dist/analytics-CzFlN5Uy.js` supports disabling telemetry with `MASTRA_TELEMETRY_DISABLED`.
Deployment uploads are tied to explicit deploy commands and authenticated Mastra Platform APIs.
No source evidence of arbitrary credential harvesting, stealth persistence, remote payload execution, or destructive behavior.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

Source & flagged code

6 flagged

dist/studio/assets/livekit-client.esm-CKIgC2IJ.jsView file

13patternName = generic_password severity = medium line = 13 matchedText = `},e.par...+`\r

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/studio/assets/livekit-client.esm-CKIgC2IJ.jsView on unpkg · L13

dist/studio/assets/tsx-B6W0miNI.jsView file

Lines 1-2javascript

1const e=Object.freeze(JSON.parse(`{"displayName":"TSX","name":"tsx","patterns":[{"include":"#directives"},{"include":"#statements"},{"include":"#shebang"}],"repository":{"access-modifier":{"match":"(?<![_$[:alnum:]])(?:(?<=\\\\.\\\\.\\\\.)|(?<!\\\\.))(abstract|declare|override|public|protected|private|readonly|static)(?![_$[:alnum:]])(?:(?=\\\\.\\\\.\\\\.)|(?!\\\\.))","name":"storage.modifier.tsx"},"after-operator-block-as-object-literal":{"begin":"(?<!\\\\+\\\\+|--)(?<=[:=(,\\\\[?+!>]|^await|[^\\\\._$[:alnum:]]await|^return|[^\\\\._$[:alnum:]]return|^yield|[^\\\\._$[:alnum:]]yield|^throw|[^\\ ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/studio/assets/tsx-B6W0miNI.jsView on unpkg · L1

Long lines were clipped for display.

dist/analytics-CzFlN5Uy.jsView file

Lines 1-32javascript

1import { a as loadCredentials, i as getToken } from "./credentials-CE1thn6C.js";

2import { r as resolveCurrentOrg } from "./orgs-DOhO9kNz.js";

3import { InvalidArgumentError } from "commander";

dist/studio/assets/main-tYRi5VOV.jsView file

•path = dist/studio/assets/main-tYRi5VOV.js kind = oversized_source_file sizeBytes = 6997087 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/studio/assets/main-tYRi5VOV.jsView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = mastra@1.20.3 matchedIdentity = npm:bWFzdHJh:1.20.3 similarity = 0.829 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/studio/assets/livekit-client.esm-CKIgC2IJ.jsView file

13patternName = generic_password severity = medium line = 13 matchedText = `},e.par...+`\r

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/studio/assets/livekit-client.esm-CKIgC2IJ.jsView on unpkg · L13

dist/studio/assets/tsx-B6W0miNI.jsView file

1const e=Object.freeze(JSON.parse(`{"displayName":"TSX","name":"tsx","patterns":[{"include":"#directives"},{"include":"#statements"},{"include":"#shebang"}],"repository":{"access-mo...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/studio/assets/tsx-B6W0miNI.jsView on unpkg · L1

dist/analytics-CzFlN5Uy.jsView file

Findings

3 Critical7 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationdist/analytics-CzFlN5Uy.js

CriticalTrigger Reachable Dangerous Capabilitydist/analytics-CzFlN5Uy.js

CriticalPrevious Version Dangerous Deltadist/index.js

MediumSecret Patterndist/studio/assets/livekit-client.esm-CKIgC2IJ.js

MediumDynamic Requiredist/studio/assets/tsx-B6W0miNI.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumOversized Source Filedist/studio/assets/main-tYRi5VOV.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings