All @mastra/longmemeval versions
@mastra/longmemeval @1.0.50
rejected
This version was rejected.
It did not pass GreenFlagged's security review and is not served by the registry.
The findings and risk dispositions below explain why.
48
Risk Score
—
License
No
Install Scripts
23
Dependencies
6
Dev Dependencies
295.4 KB
Package Size
Published
LongMemEval benchmark implementation for Mastra Memory
Maintainers
ehindero
Dependencies (23)
| Package | Constraint | Registry Status |
|---|---|---|
| ai | ^5.0.154 | auto_approved |
| ora | ^8.2.0 | auto_approved |
| zod | ^3.25.76 | auto_approved |
| chalk | ^5.6.2 | auto_approved |
| fastq | ^1.20.1 | auto_approved |
| dotenv | ^16.6.1 | auto_approved |
| openai | ^4.104.0 | auto_approved |
| commander | ^12.1.0 | auto_approved |
| imvectordb | ^0.0.6 | auto_approved |
| @mastra/rag | 2.2.1 | auto_approved |
| async-mutex | ^0.5.0 | auto_approved |
| easy-day-js | ^1.11.21 | auto_approved |
| xxhash-wasm | ^1.1.0 | auto_approved |
| @mastra/core | 1.42.0 | auto_approved |
| @ai-sdk/google | ^2.0.62 | auto_approved |
| @ai-sdk/openai | ^2.0.99 | auto_approved |
| @mastra/libsql | 1.13.0 | auto_approved |
| @mastra/memory | 1.20.3 | auto_approved |
| @node-rs/xxhash | ^1.7.6 | auto_approved |
| @ai-sdk/provider | ^2.0.1 | auto_approved |
| @huggingface/hub | ^0.15.2 | No greenflagged match |
| @mastra/fastembed | 1.1.2 | No greenflagged match |
| @ai-sdk/provider-utils | ^3.0.22 | auto_approved |
Dev Dependencies (6)
| Package | Constraint | Registry Status |
|---|---|---|
| tsx | ^4.22.4 | auto_approved |
| vitest | 4.1.5 | No greenflagged match |
| @vitest/ui | 4.1.5 | auto_approved |
| typescript | ^6.0.3 | auto_approved |
| @types/node | 22.19.13 | auto_approved |
| @vitest/coverage-v8 | 4.1.5 | auto_approved |
Transitive Dependency Tree
300 transitive deps
max depth 7
├─
@ai-sdk/google
^2.0.62
→ 2.0.80
├─
@ai-sdk/openai
^2.0.99
→ 2.0.112
├─
@ai-sdk/provider
^2.0.1
→ 2.0.3
├─
@ai-sdk/provider-utils
^3.0.22
→ 3.0.29
├─
@huggingface/hub
^0.15.2
├─
@mastra/core
1.42.0
→ 1.42.0
├─
@mastra/fastembed
1.1.2
├─
@mastra/libsql
1.13.0
→ 1.13.0
├─
@mastra/memory
1.20.3
→ 1.20.3
├─
@mastra/rag
2.2.1
→ 2.2.1
├─
@node-rs/xxhash
^1.7.6
→ 1.7.6
├─
ai
^5.0.154
→ 5.0.213
├─
async-mutex
^0.5.0
→ 0.5.0
├─
chalk
^5.6.2
→ 5.6.2
├─
commander
^12.1.0
→ 12.1.0
├─
dotenv
^16.6.1
→ 16.6.1
├─
easy-day-js
^1.11.21
→ 1.11.21
├─
fastq
^1.20.1
→ 1.20.1
├─
imvectordb
^0.0.6
→ 0.0.6
├─
openai
^4.104.0
→ 4.104.0
├─
ora
^8.2.0
→ 8.2.0
├─
xxhash-wasm
^1.1.0
→ 1.1.0
├─
zod
^3.25.76
→ 3.25.76
├─
@a2a-js/sdk
~0.3.13
→ 0.3.14
├─
@ai-sdk/gateway
2.0.112
→ 2.0.112
├─
@isaacs/ttlcache
^2.1.4
→ 2.1.5
├─
@libsql/client
^0.17.3
→ 0.17.4
├─
@lukeed/uuid
^2.0.1
→ 2.0.1
├─
@mastra/schema-compat
1.2.11
→ 1.2.11
├─
@modelcontextprotocol/sdk
^1.29.0
→ 1.29.0
├─
@opentelemetry/api
1.9.0
→ 1.9.0
├─
@paralleldrive/cuid2
^2.3.1
→ 2.3.1
├─
@sindresorhus/slugify
^2.2.1
→ 2.2.1
├─
@standard-schema/spec
^1.1.0
→ 1.1.0
├─
@types/node
^18.11.18
→ 18.19.130
├─
@types/node-fetch
^2.6.4
→ 2.6.13
├─
abort-controller
^3.0.0
→ 3.0.0
├─
agentkeepalive
^4.2.1
→ 4.6.0
├─
ajv
^8.18.0
→ 8.20.0
├─
big.js
^7.0.1
→ 7.0.1
├─
chat
^4.29.0
→ 4.34.0
├─
cli-cursor
^5.0.0
→ 5.0.0
├─
cli-spinners
^2.9.2
→ 2.9.2
├─
croner
^10.0.1
→ 10.0.1
├─
diff
^8.0.3
→ 8.0.4
├─
eventsource-parser
^3.0.6
→ 3.1.0
├─
execa
^9.6.1
→ 9.6.1
├─
form-data-encoder
1.7.2
→ 1.7.2
├─
formdata-node
^4.3.2
→ 4.4.1
├─
gray-matter
^4.0.3
→ 4.0.3
├─
ignore
^7.0.5
→ 7.0.6
├─
image-size
^2.0.2
→ 2.0.2
├─
is-interactive
^2.0.0
→ 2.0.0
├─
is-unicode-supported
^2.0.0
→ 2.1.0
├─
js-tiktoken
^1.0.21
→ 1.0.21
├─
json-schema
^0.4.0
→ 0.4.0
├─
log-symbols
^6.0.0
→ 6.0.0
├─
lru-cache
^11.2.7
→ 11.5.2
├─
node-fetch
^2.6.7
→ 2.7.0
├─
node-html-better-parser
^1.5.8
→ 1.5.8
├─
p-map
^7.0.4
→ 7.0.5
├─
p-retry
^7.1.1
→ 7.1.1
├─
pathe
^2.0.3
→ 2.0.3
├─
picomatch
^4.0.3
→ 4.0.5
├─
posthog-node
^5.30.6
→ 5.42.0
├─
probe-image-size
^7.2.3
→ 7.3.0
├─
reusify
^1.0.4
→ 1.1.0
├─
stdin-discarder
^0.2.2
→ 0.2.2
├─
string-width
^7.2.0
→ 7.2.0
├─
strip-ansi
^7.1.0
→ 7.2.0
├─
tokenx
^1.3.0
→ 1.3.0
├─
tslib
^2.4.0
→ 2.8.1
├─
ws
^8.20.0
→ 8.21.1
├─
@hono/node-server
^1.19.9
→ 1.19.14
├─
@libsql/core
^0.17.4
→ 0.17.4
├─
@libsql/hrana-client
^0.10.0
→ 0.10.0
├─
@lukeed/csprng
^1.1.0
→ 1.1.0
├─
@noble/hashes
^1.1.5
→ 1.8.0
├─
@posthog/core
^1.41.0
→ 1.41.1
├─
@sindresorhus/merge-streams
^4.0.0
→ 4.0.0
├─
@sindresorhus/transliterate
^1.0.0
→ 1.6.0
├─
@vercel/oidc
3.1.0
→ 3.1.0
├─
@workflow/serde
4.1.0-beta.2
→ 4.1.0-beta.2
├─
ajv-formats
^3.0.1
→ 3.0.1
├─
ansi-regex
^6.2.2
→ 6.2.2
├─
base64-js
^1.5.1
→ 1.5.1
├─
content-type
^1.0.5
→ 1.0.5
├─
cors
^2.8.5
→ 2.8.6
├─
cross-spawn
^7.0.5
→ 7.0.6
├─
emoji-regex
^10.3.0
├─
escape-string-regexp
^5.0.0
→ 5.0.0
├─
event-target-shim
^5.0.0
├─
eventsource
^3.0.2
→ 3.0.2
├─
express
^5.2.1
→ 5.2.1
├─
express-rate-limit
^8.2.1
→ 8.5.2
├─
fast-deep-equal
^3.1.3
→ 3.1.3
├─
fast-uri
^3.0.1
→ 3.1.3
├─
figures
^6.1.0
→ 6.1.0
├─
form-data
^4.0.4
→ 4.0.6
├─
get-east-asian-width
^1.0.0
→ 1.6.0
├─
get-stream
^9.0.0
→ 9.0.1
├─
hono
^4.11.4
→ 4.12.30
├─
html-entities
^2.3.2
→ 2.6.0
├─
human-signals
^8.0.1
→ 8.0.1
├─
humanize-ms
^1.2.1
├─
is-network-error
^1.1.0
→ 1.3.1
├─
is-plain-obj
^4.1.0
→ 4.1.0
├─
is-stream
^4.0.1
→ 4.0.1
├─
jose
^6.1.3
→ 6.2.3
├─
js-base64
^3.7.5
→ 3.9.0
├─
js-yaml
^3.13.1
→ 3.15.0
├─
json-schema-to-zod
^2.7.0
→ 2.8.1
├─
json-schema-traverse
^1.0.0
→ 1.0.0
├─
json-schema-typed
^8.0.2
→ 8.0.2
├─
kind-of
^6.0.2
→ 6.0.3
├─
libsql
^0.5.28
→ 0.5.29
├─
lodash.merge
^4.6.2
→ 4.6.2
├─
mdast-util-to-string
^4.0.0
→ 4.0.0
├─
needle
^2.5.2
→ 2.9.1
├─
node-domexception
1.0.0
→ 1.0.0
├─
npm-run-path
^6.0.0
→ 6.0.0
├─
pkce-challenge
^5.0.0
├─
pretty-ms
^9.2.0
→ 9.3.0
├─
promise-limit
^2.7.0
→ 2.7.0
├─
raw-body
^3.0.0
→ 3.0.2
├─
remark-gfm
^4.0.0
→ 4.0.1
├─
remark-parse
^11.0.0
→ 11.0.0
├─
remark-stringify
^11.0.0
→ 11.0.0
├─
remend
^1.2.1
→ 1.3.0
├─
require-from-string
^2.0.2
→ 2.0.2
├─
restore-cursor
^5.0.0
→ 5.1.0
├─
section-matter
^1.0.0
→ 1.0.0
├─
signal-exit
^4.1.0
→ 4.1.0
├─
stream-parser
~0.3.1
→ 0.3.1
├─
strip-bom-string
^1.0.0
├─
strip-final-newline
^4.0.0
→ 4.0.0
├─
undici-types
~5.26.4
→ 5.26.5
├─
unified
^11.0.5
→ 11.0.5
├─
uuid
^11.1.0
→ 11.1.0
├─
web-streams-polyfill
4.0.0-beta.3
├─
whatwg-url
^5.0.0
→ 5.0.0
├─
yoctocolors
^2.1.1
→ 2.1.2
├─
zod-from-json-schema
^0.5.2
→ 0.5.5
├─
zod-from-json-schema-v3
npm:zod-from-json-schema@^0.0.5
├─
zod-to-json-schema
^3.25.1
→ 3.25.2
├─
@libsql/isomorphic-ws
^0.1.5
├─
@neon-rs/load
^0.0.4
├─
@posthog/types
^1.394.0
→ 1.394.0
├─
@sec-ant/readable-stream
^0.4.1
├─
@types/mdast
^4.0.0
→ 4.0.4
├─
@types/unist
^3.0.0
→ 3.0.3
├─
accepts
^2.0.0
→ 2.0.0
├─
argparse
^1.0.7
→ 1.0.10
├─
asynckit
^0.4.0
→ 0.4.0
├─
bail
^2.0.0
→ 2.0.2
├─
body-parser
^2.2.1
→ 2.3.0
├─
bytes
~3.1.2
→ 3.1.2
├─
combined-stream
^1.0.8
→ 1.0.8
├─
content-disposition
^1.0.0
→ 1.1.0
├─
cookie
^0.7.1
→ 0.7.2
├─
cookie-signature
^1.2.1
→ 1.2.2
├─
debug
2
→ 2.6.9
├─
depd
^2.0.0
→ 2.0.0
├─
detect-libc
2.0.2
→ 2.0.2
├─
devlop
^1.0.0
→ 1.1.0
├─
encodeurl
^2.0.0
→ 2.0.0
├─
es-set-tostringtag
^2.1.0
→ 2.1.0
├─
escape-html
^1.0.3
→ 1.0.3
├─
esprima
^4.0.0
→ 4.0.1
├─
etag
^1.8.1
→ 1.8.1
├─
extend
^3.0.0
→ 3.0.2
├─
extend-shallow
^2.0.1
├─
finalhandler
^2.1.0
→ 2.1.1
├─
fresh
^2.0.0
→ 2.0.0
├─
hasown
^2.0.4
→ 2.0.4
├─
http-errors
~2.0.1
→ 2.0.1
├─
iconv-lite
~0.7.0
→ 0.7.3
├─
ip-address
^10.2.0
→ 10.2.0
├─
mdast-util-from-markdown
^2.0.0
→ 2.0.3
├─
mdast-util-gfm
^3.0.0
→ 3.1.0
├─
mdast-util-to-markdown
^2.0.0
→ 2.1.2
├─
merge-descriptors
^2.0.0
→ 2.0.0
├─
micromark-extension-gfm
^3.0.0
→ 3.0.0
├─
micromark-util-types
^2.0.0
→ 2.0.2
├─
mime-types
^2.1.35
→ 2.1.35
├─
object-assign
^4
→ 4.1.1
├─
on-finished
^2.4.1
→ 2.4.1
├─
once
^1.4.0
→ 1.4.0
├─
onetime
^7.0.0
→ 7.0.0
├─
parse-ms
^4.0.0
→ 4.0.0
├─
parseurl
^1.3.3
→ 1.3.3
├─
path-key
^4.0.0
→ 4.0.0
├─
proxy-addr
^2.0.7
→ 2.0.7
├─
qs
^6.14.0
→ 6.15.3
├─
range-parser
^1.2.1
→ 1.3.0
├─
router
^2.2.0
→ 2.2.0
├─
sax
^1.2.4
→ 1.6.0
├─
send
^1.1.0
→ 1.2.1
├─
serve-static
^2.2.0
→ 2.2.1
├─
shebang-command
^2.0.0
→ 2.0.0
├─
statuses
^2.0.1
→ 2.0.2
├─
tr46
~0.0.3
→ 0.0.3
├─
trough
^2.0.0
→ 2.2.0
├─
type-is
^2.0.1
→ 2.0.1
├─
unicorn-magic
^0.3.0
→ 0.3.0
├─
unpipe
~1.0.0
→ 1.0.0
├─
vary
^1.1.2
→ 1.1.2
├─
vfile
^6.0.0
→ 6.0.3
├─
webidl-conversions
^3.0.0
→ 3.0.1
├─
which
^2.0.1
→ 2.0.2
├─
decode-named-character-reference
^1.0.0
→ 1.3.0
├─
delayed-stream
~1.0.0
→ 1.0.0
├─
dequal
^2.0.0
→ 2.0.3
├─
ee-first
1.1.1
→ 1.1.1
├─
es-define-property
^1.0.1
→ 1.0.1
├─
es-errors
^1.3.0
→ 1.3.0
├─
forwarded
0.2.0
→ 0.2.0
├─
function-bind
^1.1.2
→ 1.1.2
├─
get-intrinsic
^1.2.6
→ 1.3.1
├─
has-tostringtag
^1.0.2
→ 1.0.2
├─
inherits
~2.0.4
→ 2.0.4
├─
ipaddr.js
1.9.1
→ 1.9.1
├─
is-promise
^4.0.0
→ 4.0.0
├─
isexe
^2.0.0
→ 2.0.0
├─
longest-streak
^3.0.0
→ 3.1.0
├─
mdast-util-gfm-autolink-literal
^2.0.0
→ 2.0.1
├─
mdast-util-gfm-footnote
^2.0.0
→ 2.1.0
├─
mdast-util-gfm-strikethrough
^2.0.0
→ 2.0.0
├─
mdast-util-gfm-table
^2.0.0
→ 2.0.0
├─
mdast-util-gfm-task-list-item
^2.0.0
→ 2.0.0
├─
mdast-util-phrasing
^4.0.0
→ 4.1.0
├─
media-typer
^1.1.0
→ 1.1.0
├─
micromark
^4.0.0
→ 4.0.2
├─
micromark-extension-gfm-autolink-literal
^2.0.0
→ 2.1.0
├─
micromark-extension-gfm-footnote
^2.0.0
→ 2.1.0
├─
micromark-extension-gfm-strikethrough
^2.0.0
→ 2.1.0
├─
micromark-extension-gfm-table
^2.0.0
→ 2.1.1
├─
micromark-extension-gfm-tagfilter
^2.0.0
→ 2.0.0
├─
micromark-extension-gfm-task-list-item
^2.0.0
→ 2.1.0
├─
micromark-util-classify-character
^2.0.0
├─
micromark-util-combine-extensions
^2.0.0
→ 2.0.1
├─
micromark-util-decode-numeric-character-reference
^2.0.0
├─
micromark-util-decode-string
^2.0.0
→ 2.0.1
├─
micromark-util-normalize-identifier
^2.0.0
├─
micromark-util-symbol
^2.0.0
├─
mime-db
1.52.0
├─
mimic-function
^5.0.0
→ 5.0.1
├─
ms
2.0.0
→ 2.0.0
├─
negotiator
^1.0.0
→ 1.0.0
├─
path-to-regexp
^8.0.0
→ 8.4.2
├─
safer-buffer
>= 2.1.2 < 3.0.0
→ 2.1.2
├─
setprototypeof
~1.2.0
→ 1.2.0
├─
shebang-regex
^3.0.0
├─
side-channel
^1.1.1
→ 1.1.1
├─
sprintf-js
~1.0.2
→ 1.0.3
├─
toidentifier
~1.0.1
→ 1.0.1
├─
unist-util-stringify-position
^4.0.0
→ 4.0.0
├─
unist-util-visit
^5.0.0
→ 5.0.0
├─
vfile-message
^4.0.0
→ 4.0.3
├─
wrappy
1
→ 1.0.2
├─
zwitch
^2.0.0
→ 2.0.4
├─
@types/debug
^4.0.0
→ 4.1.13
├─
async-function
^1.0.0
├─
async-generator-function
^1.0.0
→ 1.0.0
├─
call-bind-apply-helpers
^1.0.2
→ 1.0.2
├─
ccount
^2.0.0
→ 2.0.1
├─
character-entities
^2.0.0
→ 2.0.2
├─
es-object-atoms
^1.1.1
→ 1.1.2
├─
generator-function
^2.0.0
→ 2.0.1
├─
get-proto
^1.0.1
├─
gopd
^1.2.0
→ 1.2.0
├─
has-symbols
^1.0.3
→ 1.1.0
├─
markdown-table
^3.0.0
→ 3.0.4
├─
math-intrinsics
^1.1.0
→ 1.1.0
├─
mdast-util-find-and-replace
^3.0.0
→ 3.0.2
├─
micromark-core-commonmark
^2.0.0
→ 2.0.3
├─
micromark-factory-space
^2.0.0
→ 2.0.1
├─
micromark-util-character
^2.0.0
→ 2.1.1
├─
micromark-util-chunked
^2.0.0
├─
micromark-util-encode
^2.0.0
├─
micromark-util-resolve-all
^2.0.0
├─
micromark-util-sanitize-uri
^2.0.0
→ 2.0.1
├─
micromark-util-subtokenize
^2.0.0
→ 2.1.0
├─
object-inspect
^1.13.4
→ 1.13.4
├─
side-channel-list
^1.0.1
→ 1.0.1
├─
side-channel-map
^1.0.1
→ 1.0.1
├─
side-channel-weakmap
^1.0.2
→ 1.0.2
├─
unist-util-is
^6.0.0
→ 6.0.1
├─
unist-util-visit-parents
^6.0.0
→ 6.0.2
├─
@types/ms
*
→ 2.1.0
├─
call-bound
^1.0.2
→ 1.0.4
├─
micromark-factory-destination
^2.0.0
├─
micromark-factory-label
^2.0.0
→ 2.0.1
├─
micromark-factory-title
^2.0.0
├─
micromark-factory-whitespace
^2.0.0
→ 2.0.1
├─
micromark-util-html-tag-name
^2.0.0
Changes from v1.0.49
Dependency Changes
| Change | Package | Version |
|---|---|---|
| added | easy-day-js | ^1.11.21 |
File Changes
0 added
0 removed
1 modified
size delta: +.0 KB
Risk Dispositions (2 applicable to this version, 0 other)
Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.
| Rule | Source | Disposition | Author | Reason | |
|---|---|---|---|---|---|
regressed-provenance |
provenance | reject | AI | AI (provenance): Provenance regression on a package with 850 versions and CI/CD history is a strong compromise indicator. | |
unvetted-dep:easy-day-js |
dependencies | reject | AI | AI (dependencies): Newly added unvetted dep that is also a phantom dep (not imported) — classic supply-chain injection pattern. |
SAST Findings (2)
HIGH
Provenance attestation missing — previous versions had it
provenance
This version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. The axios attack (March 2026) exhibited exactly this pattern.
INFO
Publisher changed: GitHub Actions → ehindero (on 2026-06-17, known maintainer)
provenance
This version was published by a different npm account (ehindero) than the most recent previously approved version (GitHub Actions) on 2026-06-17, but ehindero is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
Review Summary
Risk score: 48. Findings: 1 high (+25), 2 medium (+20), 1 low (+3), 10 info (+0).
Published to npm: