
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@convex-dev/mastra
Advanced tools
Use Mastra to build workflows, then use this component to run them on Convex as durable functions.
export const workflowAction = registry.define(workflow);
// ...
const { start } = await runner.create( ctx, internal.file.workflowAction);
const result = await start({...});

Found a bug? Feature request? File it here.
mastra dev and convex dev for fast iterations.hono HTTP API as Mastra servers.You'll need an existing Convex project to use the component. Convex is a hosted backend platform, including a database, serverless functions, and a ton more you can learn about here.
Run npm create convex or follow any of the quickstarts to set one up.
Install the component package:
npm install @convex-dev/mastra
NOTE: You also need to:
@libsql/clientYou can do all of this by running the following commands from the project root:
npm install -D @libsql/client
echo '{"node":{"externalPackages":["@libsql/client"]}}' > convex.json
printf '"use node";\nexport * as _ from "@libsql/client";' > convex/_libsql_workaround.ts
Create a convex.config.ts file in your app's convex/ folder and install the component by calling use:
// convex/convex.config.ts
import { defineApp } from "convex/server";
import mastra from "@convex-dev/mastra/convex.config";
const app = defineApp();
app.use(mastra);
export default app;
"use node";
import { components } from "./_generated/api";
import { WorkflowRegistry } from "@convex-dev/mastra/registry";
import { createStep, Workflow } from "@mastra/core";
const MyStep = createStep({
id: "MyStep",
execute: async ({ context, suspend }) => {
//...
},
});
const myWorkflow = new Workflow({
name: "myWorkflow",
})
.step(MyStep)
//...more steps
.commit();
const registry = new WorkflowRegistry(components.workflow);
export const myWorkflowAction = registry.define(workflow);
You can run this from any server function (mutation or action, node or otherwise)
const runner = new WorkflowRunner(components.mastra);
const { runId, startAsync, start, resume } = await runner.create(
ctx,
internal.myNodeFile.myWorkflowAction // the one you registered
);
const result = await start({...});
// OR
await startAsync({...});
// OR
await resume({...});
// Can call any of these from anywhere.
await runner.waitForCompletion(ctx, runId);
const status = await runner.getStatus(ctx, runId);
See more example usage in example.ts.
mastra dev in Node 20, but
convex dev in Node 18.
If you see issues about syscalls at import time, try using the cloud dev
environment instead.start / resume.resumeAsync? It's currently async only.mastra dev.ConvexStorage from Mastra doesn't share state with workflows
made via the Component. They're currently stored in separate tables with
different schemas.✘ [ERROR] Could not resolve "assert"
node_modules/sonic-boom/index.js:8:23:
8 │ const assert = require('assert')
╵ ~~~~~~~~
The package "assert" wasn't found on the file system but is built into node. Are you trying to
bundle for node? You can use "platform: 'node'" to do that, which will remove this error.
✖ It looks like you are using Node APIs from a file without the "use node" directive.
This is because you're using a Node API in a file that doesn't have the "use node" directive.
Or you're importing a file in your project that imports from a node dependency that doesn't have the "use node" directive.
To fix this, add the "use node" directive to the file. Note: these files can
only have actions, since mutations and queries only run in the default runtime.
FAQs
A mastra component for Convex.
We found that @convex-dev/mastra demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 14 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.