registry / @mastra/datadog / 1.3.6

@mastra/datadog@1.3.6

Datadog LLM Observability exporter for Mastra - exports tracing data to Datadog's LLM Observability product

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No confirmed malicious attack surface. The runtime exporter deliberately forwards user application trace data through the declared dd-trace dependency after explicit construction.

Static reason

One or more suspicious static signals were detected.

Trigger

Application imports the package and constructs DatadogExporter or DatadogBridge with Datadog configuration.

Impact

Expected telemetry export; no stealthy harvesting, persistence, or install-time execution found.

Mechanism

User-configured Datadog LLM observability tracing.

Rationale

The apparent environment-variable and network signals are package-aligned configuration for a documented Datadog exporter. Source inspection found no malicious execution chain or unconsented install-time behavior.

Evidence

package.jsondist/index.jsREADME.md

Network endpoints1

datadoghq.com

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no install lifecycle hooks.

@mastra/datadog@1.3.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code