@mastra/datadog@1.4.3

Datadog LLM Observability exporter for Mastra - exports tracing data to Datadog's LLM Observability product

AI Security Review

scanned 15d ago · by lpm-firewall-ai

The inspected manifest has no install lifecycle hook, and the entrypoint behavior is consistent with a Datadog exporter using declared Datadog dependencies. The environment variable references are ordinary configuration for that exporter.

Static reason

One or more suspicious static signals were detected.

Trigger

A caller initializes the exported Datadog bridge or exporter.

Impact

Span data is exported to the configured Datadog destination; no unrelated collection or recipient was identified.

Mechanism

It reads Datadog configuration and passes span data to dd-trace LLM Observability.

AI rationale

Network endpoints1

datadoghq.com

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json has no install lifecycle hook; its scripts are build, test, and lint tasks.
dist/index.js uses the configured or environment-provided Datadog site and API key to initialize dd-trace.
dist/index.js exports Mastra spans and annotations through dd-trace LLM Observability.

Evidence against

Behavioral surface

Source

EnvironmentVars

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 83.0 KB of source

Source & flagged code

5 flagged

dist/index.jsView file

Lines 1-22javascript

1import { SpanType } from "@mastra/core/observability";

2import { omitKeys } from "@mastra/core/utils";

3import { BaseExporter, getExternalParentId } from "@mastra/observability";

4import tracer from "dd-trace";

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L2

5import { coreFeatures } from "@mastra/core/features";

6//#region src/features.ts

7/**

8* Feature detection for paired @mastra/core and @mastra/observability versions.

10* `coreFeatures` is a hard peer dependency, so it can be imported statically.

11* `observabilityFeatures` is loaded via dynamic import so this exporter degrades

12* gracefully against older `@mastra/observability` versions that don't export it

13* (per the pattern documented in `observability/mastra/src/features.ts`).

14*

15* Detection runs once at module load. Callers consume the result through the

16* sync `isModelInferenceEnabled()` accessor, which conservatively returns

17* `false` until detection settles — long enough only to cover the microtask

18* window before any spans are emitted in practice.

19*/

20const FEATURE = "model-inference-span";

21let observabilityFeatures;

22let featureLoadPromise;

Lines 296-336javascript

296 } catch (error) {

297 reject(error);

298 }

299 });

300}

301/**

302* Datadog Bridge for Mastra Observability.

303*

304* Creates native dd-trace spans in real time during execution for proper APM

305* context propagation, and uses the same live dd span for Datadog LLMObs

306* tagging and annotations.

Lines 1117-1154javascript

1117 userId: traceCtx.userId,

1118 startTime,

1119 ...kind === "llm" && attrs?.model ? { modelName: attrs.model } : {},

1120 ...kind === "llm" && attrs?.provider ? { modelProvider: attrs.provider }

package.jsonView file

Lines 44-75json

44 "@openfeature/core": "^1.7.0",

45 "@openfeature/server-sdk": "^1.18.0"

46 },

47 "peerDependenciesMeta": {

48 "@openfeature/core": {

49 "optional": true

Source & flagged code

5 flagged · loading source

dist/index.jsView file

2package = @mastra/datadog; repositoryIdentity = mastra; dependency = @mastra/observability L2: import { omitKeys } from "@mastra/core/utils"; L3: import { BaseExporter, getExternalParentId } from "@mastra/observability"; L4: import tracer from "dd-trace";

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L2

316const mlApp = config.mlApp ?? process.env.DD_LLMOBS_ML_APP; const apiKey = config.apiKey ?? process.env.DD_API_KEY; const site = config.site ?? process.env.DD_SITE ?? "datadoghq.com"; const env = config.env ?? process.env.DD_ENV; const envAgentless = process.env.DD_LLMOBS_AGENTLESS_ENABLED

Low

Ai Review Evidence

dist/index.js uses the configured or environment-provided Datadog site and API key to initialize dd-trace.

dist/index.jsView on unpkg · L316

1137tracer.llmobs.trace(traceOptions, (ddSpan) => { const annotations = this.buildAnnotations(span); if (Object.keys(annotations).length > 0) tracer.llmobs.annotate(ddSpan, annotations); if (span.errorInfo) this.setErrorTag

Low

Ai Review Evidence

dist/index.js exports Mastra spans and annotations through dd-trace LLM Observability.

Findings

2 High2 Medium4 Low

HighCopied Package Dependency Bridgedist/index.js

HighSemantic Analysis Limitedpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @mastra/datadog@1.4.3.

See all versions of @mastra/datadog for other recorded verdicts.

Review the evidence and your use of @mastra/datadog@1.4.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-08 20:29:03.405Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mastra

Behavioral surface

Related packages

More from @mastra

Source & flagged code