
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
@mastra/core
Advanced tools
Affected versions:
Mastra is a framework for building AI-powered applications and agents with a modern TypeScript stack.
It includes everything you need to go from early prototypes to production-ready applications. Mastra integrates with frontend and backend frameworks like React, Next.js, and Node, or you can deploy it anywhere as a standalone server. It's the easiest way to build, tune, and scale reliable AI products.
This is the @mastra/core package, which includes the main functionality of Mastra, including agents, workflows, tools, and memory.
@mastra/core is an essential building block for a Mastra application and you most likely don't want to use it as a standalone package. Therefore we recommend following the installation guide to get started with Mastra.
You can install the package like so:
npm install @mastra/core
Mastra (/mastra) - Central orchestration class that initializes and coordinates all Mastra components. Provides dependency injection for agents, workflows, tools,
memory, storage, and other services through a unified configuration interface. Learn more about Mastra
Agents (/agent) - Autonomous AI entities that understand instructions, use tools, and complete tasks. Encapsulate LLM interactions with conversation history, tool
execution, memory integration, and behavioral guidelines. Learn more about Agents
Workflows (/workflows) - Graph-based execution engine for chaining, branching, and parallelizing LLM calls. Orchestrates complex AI tasks with state management,
error recovery, and conditional logic. Learn more about Workflows
Tools (/tools) - Functions that agents can invoke to interact with external systems. Each tool has a schema and description enabling AI to understand and use them
effectively. Supports custom tools, toolsets, and runtime context. Learn more about Tools
Memory (/memory) - Thread-based conversation persistence with semantic recall and working memory capabilities. Stores conversation history, retrieves contextually
relevant information, and maintains agent state across interactions. Learn more about Memory
MCP (/mcp) - Model Context Protocol integration enabling external tool sources. Supports SSE, HTTP, and Hono-based MCP servers with automatic tool conversion and
registration. Learn more about MCP
Observability - Type-safe observability system tracking AI operations through spans. Provides flexible tracing with event-driven exports, configurable sampling, and pluggable processors and exporters for real-time monitoring. Full observability features are available in the @mastra/observability package. Learn more about Observability
Storage (/storage) - Pluggable storage layer with standardized interfaces for multiple backends. Supports PostgreSQL, LibSQL, MongoDB, and other databases for
persisting agent data, memory, and workflow state. Learn more about Storage
Vector (/vector) - Vector operations and embedding management for semantic search. Provides unified interface for vector stores with filtering capabilities and
similarity search. Learn more about Vector
Server (/server) - HTTP server implementation built on Hono with OpenAPI support. Provides custom API routes, middleware, authentication, and runtime context for
deploying Mastra as a standalone service. Learn more about Server
Voice (/voice) - Voice interaction capabilities with text-to-speech and speech-to-text integration. Supports multiple voice providers and real-time voice
communication for agents. Learn more about Voice
Browser (/browser) - Base classes and utilities for browser automation. Provides the MastraBrowser abstract class, thread management, and screencast streaming
for building browser providers. Use with @mastra/agent-browser or @mastra/stagehand for complete browser automation. Learn more about Browser
FAQs
Unknown package
The npm package @mastra/core receives a total of 1,246,802 weekly downloads. As such, @mastra/core popularity was classified as popular.
We found that @mastra/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.