@datadog/vite-plugin@3.4.0
Datadog Vite Plugin
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe flagged command and local-runtime behavior is consistent with the plugin’s backend-function development feature. However, the package sends default production build telemetry to Datadog, and the inspected source does not establish a way to disable it, so this merits a warning rather than a malware block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The plugin runs during a production build.
Impact
Build and configuration metadata is disclosed to Datadog without a verified opt-out, so this is a telemetry concern rather than evidence of credential theft or command-output exfiltration.
Mechanism
It queues a “Build started” event containing plugin names, then POSTs the event through the shared Datadog log sender. The sender constructs a payload with package, environment, version, bundler and metadata fields.
AI rationale
The flagged command and local-runtime behavior is consistent with the plugin’s backend-function development feature. However, the package sends default production build telemetry to Datadog, and the inspected source does not establish a way to disable it, so this merits a warning rather than a malware block.
Evidence
dist/src/index.jsdist/src/local-execution-child.mjs
Network endpoints1
browser-http-intake.logs.datadoghq.com/v1/input/pub44d5f4eb86e1392037b7501f7adc540e
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CommonJS package entry points to dist/src/index.js, where the analytics plugin is reachable.
- In production builds, the analytics plugin queues a “Build started” event with the plugin list.
- The event is sent by POST to a hard-coded Datadog log intake endpoint; its payload includes package, environment, version, bundler and metadata fields.
- The flagged child file describes a local backend-function runtime and surfaces subprocess, filesystem, network and related operations as restricted capabilities.
Evidence against
- The manifest has no install, preinstall or postinstall lifecycle script.
- The analytics event contains a build-start message and plugin names; the inspected code does not show credentials or command output being sent in that event.
- The child runtime communicates over IPC and is used by the plugin’s local backend-function execution feature.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
Source & flagged code
7 flaggeddist/src/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @datadog/vite-plugin@3.3.1
matchedIdentity = npm:QGRhdGFkb2cvdml0ZS1wbHVnaW4:3.3.1
similarity = 0.375
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/src/index.jsView on unpkg1"use strict";var e=require("unplugin"),t=require("chalk"),n=require("async-retry"),r=require("semver"),o=require("buffer"),s=require("fs/promises"),i=require("fs"),a=require("json-...
L2: //# sourceMappingURL=index.js.map
High
1"use strict";var e=require("unplugin"),t=require("chalk"),n=require("async-retry"),r=require("semver"),o=require("buffer"),s=require("fs/promises"),i=require("fs"),a=require("json-...
L2: //# sourceMappingURL=index.js.map
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
Findings
1 Critical5 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/src/index.js
HighChild Processdist/src/index.js
HighSame File Env Network Executiondist/src/index.js
HighCommand Output Exfiltrationdist/src/index.js
HighCross File Remote Execution Contextdist/src/index.js
HighTrigger Reachable Command Output Exfiltrationdist/src/index.js
MediumDynamic Requiredist/src/local-execution-child.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumGit Dependency
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to @datadog/vite-plugin@3.4.0.
See all versions of @datadog/vite-plugin for other recorded verdicts.
- Review the evidence and your use of @datadog/vite-plugin@3.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.