registry / @datadog/ai-setup-cli / 2.0.35
@datadog/ai-setup-cli@2.0.35
Interactive tool for Datadog setup
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package’s verification flow launches a project-controlled dev script without a separate confirmation and passes it the full CLI environment. This creates a real secret-exposure risk, although the feature is scoped to interactive RUM verification and no malicious collection or transmission is shown in the package source.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
After successful setup for an interactive browser-RUM product, unless the run is cancelled.
Impact
A project dev script can execute arbitrary code and could transmit inherited credentials or other environment data.
Mechanism
The CLI spawns the project’s package-manager dev script with `env` copied from `process.env`, then runs a headless browser against the local app.
AI rationale
The package’s verification flow launches a project-controlled dev script without a separate confirmation and passes it the full CLI environment. This creates a real secret-exposure risk, although the feature is scoped to interactive RUM verification and no malicious collection or transmission is shown in the package source.
Evidence
dist/lib/gpe/dev-server-verify.jsdist/lib/flows/GpeEngine.js
Network endpoints2
localhost:<ephemeral-port>RUM intake matching `browser-intake-*` or `/api/v2/rum`
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- After successful setup, non-headless browser-RUM runs start telemetry verification unless the user has cancelled.
- Verification starts the project’s package-manager `dev` script and passes it the full inherited `process.env`.
- It runs `chrome-devtools-mcp@latest` through `npx` and loads the project on an ephemeral localhost port.
- The feature is scoped to interactive products whose profiles inject real credentials; the stated purpose is to verify RUM beacons.
Evidence against
- The verification runs after the setup flow and is limited to browser-RUM products in interactive mode.
- The browser load is directed to the project’s local server, and the expected telemetry is RUM beacon traffic.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedbin/cli.cjsView file
15// is touched. If the version is too old we exit cleanly with a clear message.
L16: // If the version is fine we hand off to dist/cli.js via dynamic import().
L17: //
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/cli.cjsView on unpkg · L15dist/lib/execute/execute.test.jsView file
1// Unless explicitly stated otherwise all files in this repository are licensed under the Apache License Version 2.0.
L2: // This product includes software developed at Datadog (https://www.datadoghq.com/) Copyright 2025-Present Datadog, Inc.
L3: import test from 'ava';
...
L409: mkdirSync(join(dir, 'web'));
L410: writeFileSync(join(dir, 'web', 'package.json'), '{"name":"web"}\n'); // node app
L411: applyPlan(composeDatadogPlan(['apm']), dir);
...
L564: t.regex(sh, /install_script_agent7\.sh/); // recognized_install_pattern
L565: t.regex(sh, /systemctl enable/); // agent_runs_as_service
L566: t.regex(sh, /\$\{DD_API_KEY\}/); // secrets_not_inlined
...
L637: });
L638: const env = readFileSync(join(dir, '.env'), 'utf-8');
L639: t.regex(env, new RegExp(`DD_API_KEY=${REAL_KEY}`), 'real key
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
Findings
2 High6 Medium4 Low
HighSemantic Analysis Limiteddist/cli.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/lib/gpe/dev-server-verify.js
MediumDynamic Requirebin/cli.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/lib/execute/execute.test.js
MediumAi Review Evidencedist/lib/flows/GpeEngine.js
MediumAi Review Evidencedist/lib/gpe/dev-server-verify.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @datadog/ai-setup-cli@2.0.35.
See all versions of @datadog/ai-setup-cli for other recorded verdicts.
- Review the evidence and your use of @datadog/ai-setup-cli@2.0.35 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.