← Home

@mastra/schema-compat

Tool schema compatibility layer for Mastra.ai

24
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

abhiaiyersmthomasrase-calcsamnikaiyertylerbarneswardpeet

Keywords

mastraschematoolcompatibilityzod

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff net-exec-file:dist/chunk-RMMKMUYK.js AI (source-diff): ESM twin of same bundled ajv codegen; benign build output. ai
source-diff net-exec-file:dist/chunk-77T2HV4Q.cjs AI (source-diff): Bundled ajv codegen in a schema library; not a dropper. Stable build artifact. ai
source-diff net-exec-file:dist/chunk-32GCIDQI.js AI (source-diff): ESM counterpart of same bundled ajv codegen; same false positive. ai
source-diff net-exec-file:dist/chunk-PRX3QIA2.cjs AI (source-diff): Bundled ajv codegen; network+exec pattern is false positive from schema validation library. ai
source-diff net-exec-file:dist/chunk-B6ZU4MU5.cjs AI (source-diff): Bundled AJV code with codegen + network patterns; stable FP for this build-tool package. ai
source-diff net-exec-file:dist/chunk-MXN3UURE.js AI (source-diff): ESM counterpart of same bundled AJV code; stable FP. ai
source-diff net-exec-file:dist/chunk-DOFJIM6Y.cjs AI (source-diff): Bundled AJV codegen module; code generation is AJV's core function, not dropper behavior. ai
source-diff net-exec-file:dist/chunk-VJDHNYOU.js AI (source-diff): ESM equivalent of the same bundled AJV codegen; same rationale. ai
source-diff obfuscated-file:dist/_types/@internal_ai-sdk-v5/dist/index.d.ts AI (source-diff): Same pattern — bundled internal AI SDK v5 type declarations with long lines. ai
source-diff net-exec-file:dist/chunk-ROFMEFEF.cjs AI (source-diff): Bundled AJV codegen code; no actual network+exec malware pattern, just schema validation library internals. ai
source-diff obfuscated-file:dist/_types/@internal_ai-sdk-v4/dist/index.d.ts AI (source-diff): Long-line TypeScript declaration file for bundled AI SDK types; not obfuscation. ai
source-diff net-exec-file:dist/chunk-QDRBTCDV.js AI (source-diff): ESM equivalent of the same bundled AJV codegen; false positive from bundler output. ai
source-diff obfuscated-file:dist/_types/@internal_ai-v6/dist/index.d.ts AI (source-diff): Long-line TypeScript declaration file for AI SDK types; minified .d.ts is normal for large type bundles, not obfuscation. ai
source-diff net-exec-file:dist/chunk-DGOXVQNP.js AI (source-diff): ESM equivalent of the same AJV bundle; same rationale as the CJS variant. ai
source-diff net-exec-file:dist/chunk-DAVEUCUM.cjs AI (source-diff): Bundled AJV (JSON schema validator) internals; network+codegen patterns are AJV's legitimate code generation, not dropper malware. ai
provenance publisher-changed AI (provenance): Transition to GitHub Actions CI publisher with SLSA provenance; consistent with mastra-ai org automation. ai
dependencies unvetted-dep:json-schema-to-zod AI (dependencies): Expected dependency for a schema-compat layer; purpose-aligned and widely used. ai
dependencies unvetted-dep:zod-from-json-schema-v3 AI (dependencies): Alias for zod-from-json-schema@^0.0.5 for zod v3 compat; purpose-aligned for this package. ai

Versions (showing 24 of 24)

Version Deps Published
1.3.4 4 / 24
1.3.1 4 / 24
1.3.0 4 / 24
1.2.13 4 / 24
1.2.11 4 / 24
1.2.10 4 / 24
1.2.9 4 / 24
1.2.8 4 / 24
1.2.7 4 / 19
1.2.6 4 / 19
1.2.5 4 / 19
1.2.4 4 / 19
1.2.3 4 / 19
1.2.2 4 / 19
1.2.1 4 / 19
1.2.0 4 / 19
1.1.3 4 / 18
1.1.2 4 / 18
1.1.1 4 / 18
1.1.0 4 / 18
1.0.0 4 / 12
0.11.9 5 / 10
0.11.8 4 / 10
0.11.7 4 / 10

v1.3.4

3 findings
HIGH New file with network + code execution: dist/chunk-77T2HV4Q.cjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: dist/chunk-RMMKMUYK.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.