@mastra/datadog@1.4.17

Datadog LLM Observability exporter for Mastra - exports tracing data to Datadog's LLM Observability product

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Source inspection found no install lifecycle hook or concrete attack behavior. The scanner's dependency bridge signal corresponds to imports of dependencies declared by this Datadog integration.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer imports and configures or instantiates the exported Datadog bridge or exporter.

Impact

Tracing data is exported for the consumer's configured Datadog observability setup; no unrelated recipient or other attack behavior was identified.

Mechanism

The integration initializes dd-trace and sends observability data through its Datadog LLM Observability pipeline using configured settings.

AI rationale

Source inspection found no install lifecycle hook or concrete attack behavior. The scanner's dependency bridge signal corresponds to imports of dependencies declared by this Datadog integration.

Evidence

package.jsondist/index.js

Network endpoints1

datadoghq.com

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json declares dd-trace and @mastra/observability as runtime dependencies.
package.json lists build, test, and lint scripts, with no install lifecycle hook.
dist/index.js imports those declared dependencies and exports the Datadog bridge and exporter.
The exported runtime initializes Datadog tracing from configured settings; its default site is datadoghq.com.

Evidence against

Behavioral surface

Source

EnvironmentVars

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 90.3 KB of source

Source & flagged code

7 flagged

dist/index.jsView file

Lines 1-22javascript

1import { SpanType } from "@mastra/core/observability";

2import { omitKeys } from "@mastra/core/utils";

3import { BaseExporter, getExternalParentId } from "@mastra/observability";

4import tracer from "dd-trace";

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L2

5import { coreFeatures } from "@mastra/core/features";

Low

Suspicious Dependency Evidence

dist/index.js imports those declared dependencies and exports the Datadog bridge and exporter.

dist/index.jsView on unpkg · L1

6//#region src/features.ts

7/**

8* Feature detection for paired @mastra/core and @mastra/observability versions.

10* `coreFeatures` is a hard peer dependency, so it can be imported statically.

11* `observabilityFeatures` is loaded via dynamic import so this exporter degrades

12* gracefully against older `@mastra/observability` versions that don't export it

13* (per the pattern documented in `observability/mastra/src/features.ts`).

14*

15* Detection runs once at module load. Callers consume the result through the

16* sync `isModelInferenceEnabled()` accessor, which conservatively returns

17* `false` until detection settles — long enough only to cover the microtask

18* window before any spans are emitted in practice.

19*/

20const FEATURE = "model-inference-span";

21let observabilityFeatures;

22let featureLoadPromise;

Lines 103-143javascript

103 [SpanType.TOOL_CALL]: "tool",

104 [SpanType.MCP_TOOL_CALL]: "tool",

105 [SpanType.PROVIDER_TOOL_CALL]: "tool",

106 [SpanType.WORKFLOW_RUN]: "workflow"

107};

108/**

109* Resolves the active span-type → Datadog kind mapping based on whether the

Lines 315-355javascript

315/**

316* Datadog Bridge for Mastra Observability.

317*

318* Creates native dd-trace spans in real time during execution for proper APM

319* context propagation, and uses the same live dd span for Datadog LLMObs

320* tagging and annotations.

321*/

322var DatadogBridge = class extends BaseExporter {

323 name

Lines 1222-1244javascript

1222 const childInheritedModelAttrs = span.type === SpanType.MODEL_GENERATION ? {

1223 model: span.attributes?.model,

1224 provider: span.attributes?.provider

1225 } : inheritedModelAttrs;

1226 this.pendingSend = true;

package.jsonView file

Lines 4-74json

4 "description": "Datadog LLM Observability exporter for Mastra - exports tracing data to Datadog's LLM Observability product",

5 "type": "module",

6 "main": "dist/index.js",

7 "types": "dist/index.d.ts",

8 "files"

Source & flagged code

7 flagged · loading source

dist/index.jsView file

2package = @mastra/datadog; repositoryIdentity = mastra; dependency = @mastra/observability L2: import { omitKeys } from "@mastra/core/utils"; L3: import { BaseExporter, getExternalParentId } from "@mastra/observability"; L4: import tracer from "dd-trace";

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L2

1import { SpanType } from "@mastra/core/observability"; import { omitKeys } from "@mastra/core/utils"; import { BaseExporter, getExternalParentId } from "@mastra/observability"; import tracer from "dd-trace"; import { coreFea

Low

Suspicious Dependency Evidence

dist/index.js imports those declared dependencies and exports the Datadog bridge and exporter.

dist/index.jsView on unpkg · L1

1242export { DatadogBridge, DatadogExporter }; //# sourceMappingURL=index.js.map

Low

Suspicious Dependency Evidence

dist/index.js imports those declared dependencies and exports the Datadog bridge and exporter.

dist/index.jsView on unpkg · L1242

Findings

1 High2 Medium7 Low

HighCopied Package Dependency Bridgedist/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowSuspicious Dependency Evidencepackage.json

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Dependency Evidencedist/index.js

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @mastra/datadog@1.4.17.

See all versions of @mastra/datadog for other recorded verdicts.

Review the evidence and your use of @mastra/datadog@1.4.17 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-15 22:15:12.651Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mastra

Behavioral surface

Related packages

More from @mastra

Source & flagged code