@mastra/schema-compat
Tool schema compatibility layer for Mastra.ai
24
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
abhiaiyersmthomasrase-calcsamnikaiyertylerbarneswardpeet
Keywords
mastraschematoolcompatibilityzod
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:dist/chunk-RMMKMUYK.js | AI (source-diff): ESM twin of same bundled ajv codegen; benign build output. | ai | |
| source-diff | net-exec-file:dist/chunk-77T2HV4Q.cjs | AI (source-diff): Bundled ajv codegen in a schema library; not a dropper. Stable build artifact. | ai | |
| source-diff | net-exec-file:dist/chunk-32GCIDQI.js | AI (source-diff): ESM counterpart of same bundled ajv codegen; same false positive. | ai | |
| source-diff | net-exec-file:dist/chunk-PRX3QIA2.cjs | AI (source-diff): Bundled ajv codegen; network+exec pattern is false positive from schema validation library. | ai | |
| source-diff | net-exec-file:dist/chunk-B6ZU4MU5.cjs | AI (source-diff): Bundled AJV code with codegen + network patterns; stable FP for this build-tool package. | ai | |
| source-diff | net-exec-file:dist/chunk-MXN3UURE.js | AI (source-diff): ESM counterpart of same bundled AJV code; stable FP. | ai | |
| source-diff | net-exec-file:dist/chunk-DOFJIM6Y.cjs | AI (source-diff): Bundled AJV codegen module; code generation is AJV's core function, not dropper behavior. | ai | |
| source-diff | net-exec-file:dist/chunk-VJDHNYOU.js | AI (source-diff): ESM equivalent of the same bundled AJV codegen; same rationale. | ai | |
| source-diff | obfuscated-file:dist/_types/@internal_ai-sdk-v5/dist/index.d.ts | AI (source-diff): Same pattern — bundled internal AI SDK v5 type declarations with long lines. | ai | |
| source-diff | net-exec-file:dist/chunk-ROFMEFEF.cjs | AI (source-diff): Bundled AJV codegen code; no actual network+exec malware pattern, just schema validation library internals. | ai | |
| source-diff | obfuscated-file:dist/_types/@internal_ai-sdk-v4/dist/index.d.ts | AI (source-diff): Long-line TypeScript declaration file for bundled AI SDK types; not obfuscation. | ai | |
| source-diff | net-exec-file:dist/chunk-QDRBTCDV.js | AI (source-diff): ESM equivalent of the same bundled AJV codegen; false positive from bundler output. | ai | |
| source-diff | obfuscated-file:dist/_types/@internal_ai-v6/dist/index.d.ts | AI (source-diff): Long-line TypeScript declaration file for AI SDK types; minified .d.ts is normal for large type bundles, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/chunk-DGOXVQNP.js | AI (source-diff): ESM equivalent of the same AJV bundle; same rationale as the CJS variant. | ai | |
| source-diff | net-exec-file:dist/chunk-DAVEUCUM.cjs | AI (source-diff): Bundled AJV (JSON schema validator) internals; network+codegen patterns are AJV's legitimate code generation, not dropper malware. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions CI publisher with SLSA provenance; consistent with mastra-ai org automation. | ai | |
| dependencies | unvetted-dep:json-schema-to-zod | AI (dependencies): Expected dependency for a schema-compat layer; purpose-aligned and widely used. | ai | |
| dependencies | unvetted-dep:zod-from-json-schema-v3 | AI (dependencies): Alias for zod-from-json-schema@^0.0.5 for zod v3 compat; purpose-aligned for this package. | ai |
Versions (showing 24 of 24)
| Version | Deps | Published |
|---|---|---|
| 1.3.4 | 4 / 24 | |
| 1.3.1 | 4 / 24 | |
| 1.3.0 | 4 / 24 | |
| 1.2.13 | 4 / 24 | |
| 1.2.11 | 4 / 24 | |
| 1.2.10 | 4 / 24 | |
| 1.2.9 | 4 / 24 | |
| 1.2.8 | 4 / 24 | |
| 1.2.7 | 4 / 19 | |
| 1.2.6 | 4 / 19 | |
| 1.2.5 | 4 / 19 | |
| 1.2.4 | 4 / 19 | |
| 1.2.3 | 4 / 19 | |
| 1.2.2 | 4 / 19 | |
| 1.2.1 | 4 / 19 | |
| 1.2.0 | 4 / 19 | |
| 1.1.3 | 4 / 18 | |
| 1.1.2 | 4 / 18 | |
| 1.1.1 | 4 / 18 | |
| 1.1.0 | 4 / 18 | |
| 1.0.0 | 4 / 12 | |
| 0.11.9 | 5 / 10 | |
| 0.11.8 | 4 / 10 | |
| 0.11.7 | 4 / 10 |
v1.3.4
3 findings
HIGH
New file with network + code execution: dist/chunk-77T2HV4Q.cjs
source-diff
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
HIGH
New file with network + code execution: dist/chunk-RMMKMUYK.js
source-diff
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.