@mastra/datadog@1.4.15

Datadog LLM Observability exporter for Mastra - exports tracing data to Datadog's LLM Observability product

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Inspected package.json and the flagged dist/index.js entrypoint. The environment-variable references and tracer setup support the package's stated Datadog exporter function; no concrete attack surface was found.

Static reason

One or more suspicious static signals were detected.

Trigger

Application code imports and constructs the Datadog bridge exporter.

Impact

No unconsented install-time behavior, unrelated credential forwarding, or other attack behavior was established.

Mechanism

The exporter reads Datadog settings from its configuration or Datadog environment variables, then initializes dd-trace for tracing export.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json declares only the Datadog tracing and Mastra observability runtime dependencies, with no install lifecycle scripts.
dist/index.js implements a Datadog exporter that reads its application settings and optional API key from caller configuration or Datadog environment variables.
The exporter initializes dd-trace as part of bridge construction and uses it to export tracing data to Datadog.

Evidence against

Behavioral surface

Source

EnvironmentVars

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 83.0 KB of source

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-22javascript

1import { SpanType } from "@mastra/core/observability";

2import { omitKeys } from "@mastra/core/utils";

3import { BaseExporter, getExternalParentId } from "@mastra/observability";

4import tracer from "dd-trace";

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L2

5import { coreFeatures } from "@mastra/core/features";

6//#region src/features.ts

7/**

8* Feature detection for paired @mastra/core and @mastra/observability versions.

10* `coreFeatures` is a hard peer dependency, so it can be imported statically.

11* `observabilityFeatures` is loaded via dynamic import so this exporter degrades

12* gracefully against older `@mastra/observability` versions that don't export it

13* (per the pattern documented in `observability/mastra/src/features.ts`).

14*

15* Detection runs once at module load. Callers consume the result through the

16* sync `isModelInferenceEnabled()` accessor, which conservatively returns

17* `false` until detection settles — long enough only to cover the microtask

18* window before any spans are emitted in practice.

19*/

20const FEATURE = "model-inference-span";

21let observabilityFeatures;

22let featureLoadPromise;

Lines 284-336javascript

284 let settled = false;

285 const done = (error) => {

286 if (settled) return;

287 settled = true;

package.jsonView file

Lines 4-44json

4 "description": "Datadog LLM Observability exporter for Mastra - exports tracing data to Datadog's LLM Observability product",

5 "type": "module",

6 "main": "dist/index.js",

7 "types": "dist/index.d.ts",

8 "files"

Source & flagged code

4 flagged · loading source

dist/index.jsView file

2package = @mastra/datadog; repositoryIdentity = mastra; dependency = @mastra/observability L2: import { omitKeys } from "@mastra/core/utils"; L3: import { BaseExporter, getExternalParentId } from "@mastra/observability"; L4: import tracer from "dd-trace";

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L2

316process.env.DD_LLMOBS_ML_APP; const apiKey = config.apiKey ?? process.env.DD_API_KEY; const site = config.site ?? process.env.DD_SITE ?? "datadoghq.com"; const env = config.env ?? process.env.DD_ENV; const envAgentless = process.env

Low

Ai Review Evidence

dist/index.js implements a Datadog exporter that reads its application settings and optional API key from caller configuration or Datadog environment variables.

dist/index.jsView on unpkg · L316

304for proper APM * context propagation, and uses the same live dd span for Datadog LLMObs * tagging and annotations. */ var DatadogBridge = class extends BaseExporter { name = "datadog-bridge"; config; ddSpanMap = /* @__PURE

Low

Ai Review Evidence

The exporter initializes dd-trace as part of bridge construction and uses it to export tracing data to Datadog.

Findings

1 High2 Medium4 Low

HighCopied Package Dependency Bridgedist/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @mastra/datadog@1.4.15.

See all versions of @mastra/datadog for other recorded verdicts.

Review the evidence and your use of @mastra/datadog@1.4.15 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 17:13:16.046Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mastra

Behavioral surface

Related packages

More from @mastra

Source & flagged code