registry / @mastra/datadog / 1.4.13
@mastra/datadog@1.4.13
Datadog LLM Observability exporter for Mastra - exports tracing data to Datadog's LLM Observability product
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe inspected entrypoint and manifest support ordinary Datadog exporter behavior, with no install hook or concrete attack behavior. The scanner’s runtime-bridge hint is not substantiated by the inspected source.
Static reason
One or more suspicious static signals were detected.
Trigger
Application code constructs or uses the exported Datadog exporter.
Impact
Configured tracing data is sent through the Datadog tracing integration; no unrelated destination or install-time mutation was found.
Mechanism
The exporter initializes dd-trace and enables Datadog LLM observability using supplied configuration or standard Datadog environment settings.
AI rationale
The inspected entrypoint and manifest support ordinary Datadog exporter behavior, with no install hook or concrete attack behavior. The scanner’s runtime-bridge hint is not substantiated by the inspected source.
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json lists Datadog tracing and Mastra observability dependencies; it has no install lifecycle hook.
- dist/index.js initializes dd-trace and enables LLM observability as part of the exporter setup.
- The exporter reads Datadog settings from caller configuration or standard DD_* environment variables, then exports through dd-trace.
- The entrypoint exports DatadogBridge and DatadogExporter; no unrelated runtime dependency bridge or attack behavior was identified.
Evidence against
Behavioral surface
EnvironmentVars
Source & flagged code
5 flagged · loading sourcedist/index.jsView file
2package = @mastra/datadog; repositoryIdentity = mastra; dependency = @mastra/observability
L2: import { omitKeys } from "@mastra/core/utils";
L3: import { BaseExporter, getExternalParentId } from "@mastra/observability";
L4: import tracer from "dd-trace";
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/index.jsView on unpkg · L2111reTracer(config) {
if (tracerInitFlag.done) return;
if (config.site) process.env.DD_SITE = config.site;
if (config.apiKey) process.env.DD_API_KEY = config.apiKey;
if (!tracer._tracer?.started) tracer.init({
service: config.service || config.mlApp,
env: config.env || process.env.DD_ENV,
plugins: config.integrationsEnabled ?? false
});
tracer.llmobs.enable({
mlApp: config.mlApp,
agentlessEnabled: config
Low
Ai Review Evidence
dist/index.js initializes dd-trace and enables LLM observability as part of the exporter setup.
dist/index.jsView on unpkg · L111311_PURE__ */ new Map();
traceContext = /* @__PURE__ */ new Map();
openSpanCounts = /* @__PURE__ */ new Map();
constructor(config = {}) {
super(config);
const mlApp = config.mlApp ?? process.env.DD_LLMOBS_ML_APP;
const apiKey = config.apiKey ?? process.env.DD_API_KEY;
const site = config.site ?? process.env.DD_SITE ?? "datadoghq.com";
const env = config.env ?? process.env.DD_ENV;
const
Findings
1 High2 Medium5 Low
HighCopied Package Dependency Bridgedist/index.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowSuspicious Dependency Evidencedist/index.js
Affected versions and remediation
This report applies to @mastra/datadog@1.4.13.
See all versions of @mastra/datadog for other recorded verdicts.
- Review the evidence and your use of @mastra/datadog@1.4.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.