registry  /  mastracode  /  0.27.0

mastracode@0.27.0

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsTelemetryUrlStrings
ManifestNo manifest risk signals triggered.
scanned 30 file(s), 2.41 MB of source, external domains: 127.0.0.1, api.githubcopilot.com, api.groq.com, api.individual.githubcopilot.com, api.moonshot.ai, api.openai.com, api.scaleway.ai, auth.openai.com, chatgpt.com, claude.ai, cloud-api.near.ai, console.anthropic.com, dashscope-intl.aliyuncs.com, dashscope.aliyuncs.com, gateway-api.mastra.ai, github.com, integrate.api.nvidia.com, mastra.ai, mcp.example.com, models.dev, models.think.evroc.com, registry.npmjs.org, unpkg.com, us.posthog.com

Source & flagged code

9 flagged · loading source
dist/chunk-KBBNY7BJ.jsView file
3import { MC_TOOLS, getToolCategory, TOOL_CATEGORIES } from './chunk-UOFNLVKF.js'; L4: import { exec, spawn, execFile, execSync, execFileSync } from 'child_process'; L5: import { visibleWidth, Box, Text, Spacer, Input, Container, fuzzyFilter, getKeybindings, Markdown, ProcessTerminal, TUI, truncateToWidth, Editor, matchesKey, CombinedAutocompletePr...
High
Child Process

Package source references child process execution.

dist/chunk-KBBNY7BJ.jsView on unpkg · L3
2511var VALID_MODES = /* @__PURE__ */ new Set(["default", "path", "login"]); L2512: var VALID_FAMILIES = /* @__PURE__ */ new Set(["posix", "cmd", "powershell"]); L2513: var POWERSHELL_BASENAMES = /* @__PURE__ */ new Set(["pwsh", "pwsh.exe", "powershell", "powershell.exe"]);
High
Shell

Package source references shell execution.

dist/chunk-KBBNY7BJ.jsView on unpkg · L2511
3import { MC_TOOLS, getToolCategory, TOOL_CATEGORIES } from './chunk-UOFNLVKF.js'; L4: import { exec, spawn, execFile, execSync, execFileSync } from 'child_process'; L5: import { visibleWidth, Box, Text, Spacer, Input, Container, fuzzyFilter, getKeybindings, Markdown, ProcessTerminal, TUI, truncateToWidth, Editor, matchesKey, CombinedAutocompletePr... ... L449: /** L450: * Private constructor — use static factories or the options constructor. L451: */ ... L838: box.addChild( L839: new Text(theme.fg("dim", "See https://mastra.ai/models for supported providers and API key env vars."), 0, 0) L840: ); ... L1134: async function detectPackageManager() { L1135: const userAgent = process.env.npm[redacted]; L1136: if (userAgent) {
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-KBBNY7BJ.jsView on unpkg · L3
3import { MC_TOOLS, getToolCategory, TOOL_CATEGORIES } from './chunk-UOFNLVKF.js'; L4: import { exec, spawn, execFile, execSync, execFileSync } from 'child_process'; L5: import { visibleWidth, Box, Text, Spacer, Input, Container, fuzzyFilter, getKeybindings, Markdown, ProcessTerminal, TUI, truncateToWidth, Editor, matchesKey, CombinedAutocompletePr... ... L2917: // `name`/`options` are typed for OpenAI's own ids, but the underlying client L2918: // accepts any model string + baseURL — both are passed through verbatim. L2919: listeningModel: { ... L10800: }); L10801: const buffer = readFileSync(tmpFile); L10802: if (!Buffer.isBuffer(buffer) || buffer.length === 0) {
High
Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunk-KBBNY7BJ.jsView on unpkg · L3
3import { MC_TOOLS, getToolCategory, TOOL_CATEGORIES } from './chunk-UOFNLVKF.js'; L4: import { exec, spawn, execFile, execSync, execFileSync } from 'child_process'; L5: import { visibleWidth, Box, Text, Spacer, Input, Container, fuzzyFilter, getKeybindings, Markdown, ProcessTerminal, TUI, truncateToWidth, Editor, matchesKey, CombinedAutocompletePr... ... L449: /** L450: * Private constructor — use static factories or the options constructor. L451: */ ... L838: box.addChild( L839: new Text(theme.fg("dim", "See https://mastra.ai/models for supported providers and API key env vars."), 0, 0) L840: ); ... L1134: async function detectPackageManager() { L1135: const userAgent = process.env.npm[redacted]; L1136: if (userAgent) {
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-KBBNY7BJ.jsView on unpkg · L3
dist/headless.cjsView file
2L3: var chunkHADE25EX_cjs = require('./chunk-HADE25EX.cjs'); L4:
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/headless.cjsView on unpkg · L2
CHANGELOG.mdView file
99patternName = private_key_rsa severity = critical line = 99 matchedText = GITHUB_A...---"
Critical
Secret Pattern

RSA private key in CHANGELOG.md

CHANGELOG.mdView on unpkg · L99
327patternName = private_key_rsa severity = critical line = 327 matchedText = GITHUB_A...---"
Critical
Secret Pattern

RSA private key in CHANGELOG.md

CHANGELOG.mdView on unpkg · L327
README.mdView file
300patternName = private_key_rsa severity = critical line = 300 matchedText = export G...---"
Critical
Secret Pattern

RSA private key in README.md

README.mdView on unpkg · L300

Findings

3 Critical4 High5 Medium5 Low
CriticalSecret PatternCHANGELOG.md
CriticalSecret PatternCHANGELOG.md
CriticalSecret PatternREADME.md
HighChild Processdist/chunk-KBBNY7BJ.js
HighShelldist/chunk-KBBNY7BJ.js
HighSandbox Evasion Gated Capabilitydist/chunk-KBBNY7BJ.js
HighRemote Agent Bridgedist/chunk-KBBNY7BJ.js
MediumDynamic Requiredist/headless.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/chunk-KBBNY7BJ.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings