
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@mastra/deployer
Advanced tools
Affected versions:
Core deployment infrastructure for Mastra applications, handling build, packaging, and deployment processes.
npm install @mastra/deployer
The @mastra/deployer package provides the foundational deployment infrastructure for Mastra applications. It handles:
import { Deployer } from '@mastra/deployer';
// Create a deployer instance
const deployer = new Deployer({
dir: '/path/to/project',
type: 'Deploy', // or 'Dev' for development mode
});
// Install dependencies
await deployer.install();
// Write package.json
await deployer.writePackageJson();
// Get Mastra instance
const { mastra } = await deployer.getMastra();
dir: Project directory pathtype: Deployment type ('Deploy' or 'Dev').mastra directory.env.env.development.env.localThe deployer creates and manages the following structure:
your-project/
├── .mastra/
│ ├── package.json
│ ├── mastra.mjs
│ └── index.mjs
├── .env
├── .env.development
├── .env.local
└── package.json
The deployer automatically manages dependencies in the .mastra/package.json:
{
"name": "server",
"version": "1.0.0",
"type": "module",
"dependencies": {
"@mastra/loggers": "latest",
"hono": "4.6.17",
"@hono/node-server": "^1.13.7",
"superjson": "^2.2.2",
"zod-to-json-schema": "^3.24.1"
}
}
install()Installs and updates project dependencies.
writePackageJson()Generates or updates the package.json in the .mastra directory.
getMastra()Returns the Mastra instance for the project.
getMastraPath()Returns the path to the .mastra directory.
The deployer includes comprehensive error handling for:
Built-in logging support through @mastra/core:
@mastra/core: Core Mastra functionality@mastra/loggers: Logging infrastructure@mastra/deployer-cloudflareFAQs
Unknown package
The npm package @mastra/deployer receives a total of 493,360 weekly downloads. As such, @mastra/deployer popularity was classified as popular.
We found that @mastra/deployer demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.