registry / @datadog/ai-setup-cli / 2.0.23
@datadog/ai-setup-cli@2.0.23
Interactive tool for Datadog setup
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
2 flaggedbin/cli.cjsView file
15// is touched. If the version is too old we exit cleanly with a clear message.
L16: // If the version is fine we hand off to dist/cli.js via dynamic import().
L17: //
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/cli.cjsView on unpkg · L15dist/lib/execute/execute.jsView file
87kind: 'ConfigMap',
L88: metadata: { name: 'datadog-otlp-env' },
L89: data: edit.envVars,
...
L159: echo "==> Adding Datadog Helm repo..."
L160: helm repo add datadog https://helm.datadoghq.com
L161: helm repo update
...
L222: const out = {};
L223: const text = readFileSync(join(composeBase, '.env'), 'utf-8');
L224: for (const line of text.split('\n')) {
...
L247: * `context: ./` paired with a per-service `dockerfile: ${VAR}` (the otel-demo shape:
L248: * the context is the repo root, whose own package.json would misclassify the service
L249: * as node), then falls back to the build context. `env` resolves ${VAR} in the
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/lib/execute/execute.jsView on unpkg · L87Findings
4 Medium4 Low
MediumDynamic Requirebin/cli.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/lib/execute/execute.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @datadog/ai-setup-cli@2.0.23.
See all versions of @datadog/ai-setup-cli for other recorded verdicts.
- Review the evidence and your use of @datadog/ai-setup-cli@2.0.23 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.