registry / @datadog/vite-plugin / 3.3.0
@datadog/vite-plugin@3.3.0
Datadog Vite Plugin
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete malicious lifecycle or stealth persistence was found. Because the critical runtime bundle has incomplete AST coverage while retaining network and command primitives, this should be warned rather than marked clean.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer imports and runs datadogVitePlugin during a Vite build.
Impact
Build-log content and configured metadata may be sent to the Datadog intake endpoint; no automatic install-time execution was found.
Mechanism
Conditional HTTPS log forwarding and build-time project instrumentation.
AI rationale
No concrete malicious lifecycle or stealth persistence was found. Because the critical runtime bundle has incomplete AST coverage while retaining network and command primitives, this should be warned rather than marked clean.
Evidence
dist/src/index.js
Network endpoints1
browser-http-intake.logs.datadoghq.com/v1/input/pub44d5f4eb86e1392037b7501f7adc540e
Decision evidence
public snapshotAI called this Suspicious at 68.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The manifest exposes a compiled Vite plugin entry point that executes when a consumer loads its Vite configuration.
- The runtime bundle can POST forwarded build-plugin logs and supplied context to a Datadog intake endpoint.
- The bundle imports child-process support; its minified form and incomplete static AST coverage leave its complete command-use paths unresolved.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The observed network endpoint is Datadog-owned and the log forwarding is conditional on a forward option.
- The bundle contains explicit guards intended to reject subprocess use in backend functions.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedTelemetryTrivialUrlStrings
Source & flagged code
5 flaggeddist/src/index.jsView file
1"use strict";var e=require("unplugin"),t=require("chalk"),n=require("async-retry"),o=require("buffer"),r=require("fs/promises"),i=require("fs"),s=require("json-stream-stringify"),a...
L2: //# sourceMappingURL=index.js.map
High
1"use strict";var e=require("unplugin"),t=require("chalk"),n=require("async-retry"),o=require("buffer"),r=require("fs/promises"),i=require("fs"),s=require("json-stream-stringify"),a...
L2: //# sourceMappingURL=index.js.map
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/src/index.jsView on unpkg · L11"use strict";var e=require("unplugin"),t=require("chalk"),n=require("async-retry"),o=require("buffer"),r=require("fs/promises"),i=require("fs"),s=require("json-stream-stringify"),a...
L2: //# sourceMappingURL=index.js.map
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
Findings
5 High3 Medium5 Low
HighChild Processdist/src/index.js
HighSame File Env Network Executiondist/src/index.js
HighCommand Output Exfiltrationdist/src/index.js
HighTrigger Reachable Command Output Exfiltrationdist/src/index.js
HighSemantic Analysis Limitedpackage.json
MediumNetwork
MediumEnvironment Vars
MediumGit Dependency
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @datadog/vite-plugin@3.3.0.
See all versions of @datadog/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @datadog/vite-plugin@3.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.