@datadog/ai-setup-cli@2.0.29
Interactive tool for Datadog setup
AI Security Review
scanned 12d ago · by lpm-firewall-aiThis is a conditional credential exposure risk because an operator-configured gateway can receive the Datadog bearer token without a destination restriction. The inspected source supports a warning, but does not establish covert theft or an install-time attack.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running onboarding with LLM_GATEWAY_URL set to an alternate endpoint.
Impact
A configured endpoint outside Datadog may receive the user's Datadog credential; the inspected source does not establish covert theft.
Mechanism
The CLI combines the configured gateway URL with authentication headers and passes them to the agent SDK.
AI rationale
This is a conditional credential exposure risk because an operator-configured gateway can receive the Datadog bearer token without a destination restriction. The inspected source supports a warning, but does not establish covert theft or an install-time attack.
Evidence
dist/config.jsdist/cli.js.lpm-dependency-evidence-a14dcf0f-3d9e-4020-a1b2-ba860fc7ec41/0/npm-linux/sdk.mjs
Network endpoints2
api.<site>/api/unstable/agentic-onboarding/v1/messagesLLM_GATEWAY_URL: operator-configured URL
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI obtains an OAuth access token during sign-in and stores it for later requests.
- LLM_GATEWAY_URL replaces the site-based gateway URL without a host restriction.
- The gateway configuration includes the OAuth bearer token, and the agent SDK reads the configured URL and custom headers.
- The inspected redaction receiver performs string replacement; it does not establish an account action or network transfer.
Evidence against
- The alternate gateway requires an operator to set LLM_GATEWAY_URL; the default URL uses the Datadog site.
- The inspected source does not show covert credential theft or an install-time attack.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedbin/cli.cjsView file
15// is touched. If the version is too old we exit cleanly with a clear message.
L16: // If the version is fine we hand off to dist/cli.js via dynamic import().
L17: //
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/cli.cjsView on unpkg · L15dist/lib/execute/execute.test.jsView file
1// Unless explicitly stated otherwise all files in this repository are licensed under the MIT License.
L2: // This product includes software developed at Datadog (https://www.datadoghq.com/) Copyright 2026-Present Datadog, Inc.
L3: import test from 'ava';
...
L409: mkdirSync(join(dir, 'web'));
L410: writeFileSync(join(dir, 'web', 'package.json'), '{"name":"web"}\n'); // node app
L411: applyPlan(composeDatadogPlan(['apm']), dir);
...
L564: t.regex(sh, /install_script_agent7\.sh/); // recognized_install_pattern
L565: t.regex(sh, /systemctl enable/); // agent_runs_as_service
L566: t.regex(sh, /\$\{DD_API_KEY\}/); // secrets_not_inlined
...
L637: });
L638: const env = readFileSync(join(dir, '.env'), 'utf-8');
L639: t.regex(env, new RegExp(`DD_API_KEY=${REAL_KEY}`), 'real key written (sanct
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
Findings
2 High6 Medium4 Low
HighSemantic Analysis Limiteddist/config.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/utils/native-npm-config.test.js
MediumDynamic Requirebin/cli.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/lib/execute/execute.test.js
MediumAi Review Evidencedist/utils/redaction.js
MediumAi Review Evidencedist/config.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @datadog/ai-setup-cli@2.0.29.
See all versions of @datadog/ai-setup-cli for other recorded verdicts.
- Review the evidence and your use of @datadog/ai-setup-cli@2.0.29 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.