registry / mastra / 1.26.0

mastra@1.26.0

cli for mastra

AI Security Review

scanned 5h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Network telemetry and editor configuration occur only during CLI use; editor setup is explicitly selected.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs the mastra CLI, especially init and selected platform/auth commands.

Impact

No install-time execution, unconsented broad control-surface mutation, or credential exfiltration chain was confirmed.

Mechanism

User-invoked CLI telemetry, platform API access, and optional project/editor setup.

Rationale

The scanner's alleged credential redirect and foreign-package overwrite are not supported by inspected source. The package is a user-invoked CLI with package-aligned platform/auth traffic, opt-out telemetry, and explicitly selected setup actions.

Evidence

package.jsondist/index.jsdist/analytics-BYD-0skL.jsdist/credentials-CE1thn6C.jsdist/client-x6vJatG_.js.mastra/analytics.json.cursor/mcp.json.vscode/mcp.json

Network endpoints2

us.posthog.complatform.mastra.ai

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

CLI execution initializes opt-out PostHog telemetry with system metadata.
The interactive init flow can add a Mastra MCP server to selected editor configuration.

Evidence against

package.json has no preinstall, install, or postinstall lifecycle hook.
MCP configuration is gated by explicit interactive selection; global editor choices require confirmation.
The entrypoint registers user-invoked CLI commands and parses argv.
Authentication requests target configured Mastra platform endpoints; no unrelated credential receiver was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStrings

Source & flagged code

8 flagged

dist/studio/assets/livekit-client.esm-CKIgC2IJ.jsView file

13patternName = generic_password severity = medium line = 13 matchedText = `},e.par...+`\r

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/studio/assets/livekit-client.esm-CKIgC2IJ.jsView on unpkg · L13

dist/studio/assets/tsx-B6W0miNI.jsView file

Lines 1-2javascript

1const e=Object.freeze(JSON.parse(`{"displayName":"TSX","name":"tsx","patterns":[{"include":"#directives"},{"include":"#statements"},{"include":"#shebang"}],"repository":{"access-modifier":{"match":"(?<![_$[:alnum:]])(?:(?<=\\\\.\\\\.\\\\.)|(?<!\\\\.))(abstract|declare|override|public|protected|private|readonly|static)(?![_$[:alnum:]])(?:(?=\\\\.\\\\.\\\\.)|(?!\\\\.))","name":"storage.modifier.tsx"},"after-operator-block-as-object-literal":{"begin":"(?<!\\\\+\\\\+|--)(?<=[:=(,\\\\[?+!>]|^await|[^\\\\._$[:alnum:]]await|^return|[^\\\\._$[:alnum:]]return|^yield|[^\\\\._$[:alnum:]]yield|^throw|[^\\ ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/studio/assets/tsx-B6W0miNI.jsView on unpkg · L1

Long lines were clipped for display.

dist/analytics-BYD-0skL.jsView file

Lines 1-32javascript

1import { a as loadCredentials, i as getToken } from "./credentials-CE1thn6C.js";

2import { r as resolveCurrentOrg } from "./orgs-DOhO9kNz.js";

3import { InvalidArgumentError } from "commander";

dist/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: import { access, chmod, lstat, mkdir, mkdtemp, open, readFile, readdir, readlink, rm, stat, unlink, writeFile } from "fs/promises"; fs.writeFileSync(filePath, content); await fh.writeFile(JSON.stringify(manifest, null, 2)); const { writeFile } = await import("fs/promises"); await writeFile(fileURLToPath(uploadUrl), Buffer.from(zipBuffer)); await writeFile(resolveConfigPath(dir, configFile), JSON.stringify(config, null, 2) + "\n"); await writeFile(lockPath, JSON.stringify(data), { await writeFile(lockPath, JSON.stringify(data), {

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

dist/studio/assets/main-CYSBLcdQ.jsView file

•path = dist/studio/assets/main-CYSBLcdQ.js kind = oversized_source_file sizeBytes = 7072050 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/studio/assets/main-CYSBLcdQ.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/studio/assets/livekit-client.esm-CKIgC2IJ.jsView file

13patternName = generic_password severity = medium line = 13 matchedText = `},e.par...+`\r

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/studio/assets/livekit-client.esm-CKIgC2IJ.jsView on unpkg · L13

dist/studio/assets/tsx-B6W0miNI.jsView file

1const e=Object.freeze(JSON.parse(`{"displayName":"TSX","name":"tsx","patterns":[{"include":"#directives"},{"include":"#statements"},{"include":"#shebang"}],"repository":{"access-mo...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/studio/assets/tsx-B6W0miNI.jsView on unpkg · L1

dist/analytics-BYD-0skL.jsView file

Findings

2 Critical3 High7 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationdist/analytics-BYD-0skL.js

CriticalTrigger Reachable Dangerous Capabilitydist/analytics-BYD-0skL.js

HighCredential Redirect Persistencedist/index.js

HighEntrypoint Foreign Package Code Overwritedist/analytics-BYD-0skL.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/analytics-BYD-0skL.js

MediumSecret Patterndist/studio/assets/livekit-client.esm-CKIgC2IJ.js

MediumDynamic Requiredist/studio/assets/tsx-B6W0miNI.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumOversized Source Filedist/studio/assets/main-CYSBLcdQ.js