registry / @mastra/datadog / 1.4.1

@mastra/datadog@1.4.1

Datadog LLM Observability exporter for Mastra - exports tracing data to Datadog's LLM Observability product

AI Security Review

scanned 15d ago · by lpm-firewall-ai

No malicious attack surface is established. At consumer runtime, the package can export caller-provided Mastra tracing data to Datadog through dd-trace, which is its declared purpose.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer imports the package and constructs a Datadog exporter/bridge with enabled configuration.

Impact

Intentional observability telemetry; no install-time execution, local harvesting, or unrelated endpoint is present.

Mechanism

Configured Datadog LLM observability export via dd-trace.

Rationale

The scanner signals correspond to a Datadog telemetry exporter using configured credentials and runtime span data. Source inspection found no concrete malicious chain or install-time behavior.

Evidence

package.jsondist/index.jsREADME.md

Network endpoints1

datadoghq.com

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

Runtime exporter initializes dd-trace and enables LLM observability when constructed.

@mastra/datadog@1.4.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code