@mastra/datadog@1.4.18
⚠ Under reviewDatadog LLM Observability exporter for Mastra - exports tracing data to Datadog's LLM Observability product
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe inspected source shows Datadog exporter behavior and no concrete attack. The runtime dependency dd-trace is unresolved in the supplied snapshot, so its behavior cannot be cleared from source inspection.
Decision evidence
public snapshot- The manifest declares dd-trace as a runtime dependency, and the entrypoint imports it.
- Constructing the exporter initializes dd-trace, and exported spans are passed to its LLM observability API.
- The supplied dd-trace dependency snapshot is unresolved, so its runtime behavior could not be reviewed.
- The manifest has no install lifecycle hooks, and the exporter’s Datadog initialization is consistent with its stated purpose.
Source & flagged code
5 flagged · loading sourcePackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/index.jsView on unpkg · L2The manifest declares dd-trace as a runtime dependency, and the entrypoint imports it.
dist/index.jsView on unpkg · L4Constructing the exporter initializes dd-trace, and exported spans are passed to its LLM observability API.
Findings
Affected versions and remediation
This report applies to @mastra/datadog@1.4.18.
See all versions of @mastra/datadog for other recorded verdicts.
- Review the evidence and your use of @mastra/datadog@1.4.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.