@mastra/datadog@1.4.7

Datadog LLM Observability exporter for Mastra - exports tracing data to Datadog's LLM Observability product

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Source inspection found no lifecycle execution, filesystem access, shell execution, payload loading, persistence, or unrelated exfiltration. The static signals correspond to a configured Datadog observability exporter and environment-based Datadog settings.

Static reason

One or more suspicious static signals were detected.

Trigger

Application code constructs and uses DatadogExporter or DatadogBridge with Datadog configuration.

Impact

Configured telemetry may include span inputs, outputs, metadata, tags, and evaluation data.

Mechanism

Exports supplied Mastra tracing spans through dd-trace.

AI rationale

Network endpoints1

datadoghq.com

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest defines development scripts only; it has no install lifecycle hook.
The exporter disables itself when required Datadog configuration is absent.
At runtime it converts explicitly supplied tracing spans into Datadog annotations through dd-trace.

Evidence against

The configured exporter can send trace inputs, outputs, metadata, and tags to Datadog through its declared dd-trace dependency.

Behavioral surface

Source

EnvironmentVars

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 83.0 KB of source

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-22javascript

1import { SpanType } from "@mastra/core/observability";

2import { omitKeys } from "@mastra/core/utils";

3import { BaseExporter, getExternalParentId } from "@mastra/observability";

4import tracer from "dd-trace";

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L2

5import { coreFeatures } from "@mastra/core/features";

6//#region src/features.ts

7/**

8* Feature detection for paired @mastra/core and @mastra/observability versions.

10* `coreFeatures` is a hard peer dependency, so it can be imported statically.

11* `observabilityFeatures` is loaded via dynamic import so this exporter degrades

12* gracefully against older `@mastra/observability` versions that don't export it

13* (per the pattern documented in `observability/mastra/src/features.ts`).

14*

15* Detection runs once at module load. Callers consume the result through the

16* sync `isModelInferenceEnabled()` accessor, which conservatively returns

17* `false` until detection settles — long enough only to cover the microtask

18* window before any spans are emitted in practice.

19*/

20const FEATURE = "model-inference-span";

21let observabilityFeatures;

22let featureLoadPromise;

Lines 296-336javascript

296 } catch (error) {

297 reject(error);

298 }

299 });

300}

301/**

302* Datadog Bridge for Mastra Observability.

303*

304* Creates native dd-trace spans in real time during execution for proper APM

305* context propagation, and uses the same live dd span for Datadog LLMObs

306* tagging and annotations.

package.jsonView file

Lines 46-74json

46 "peerDependenciesMeta": {

47 "@openfeature/core": {

48 "optional": true

49 },

50 "@openfeature/server-sdk": {

51 "optional": true

52 }

Source & flagged code

4 flagged · loading source

dist/index.jsView file

2package = @mastra/datadog; repositoryIdentity = mastra; dependency = @mastra/observability L2: import { omitKeys } from "@mastra/core/utils"; L3: import { BaseExporter, getExternalParentId } from "@mastra/observability"; L4: import tracer from "dd-trace";

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L2

316const mlApp = config.mlApp ?? process.env.DD_LLMOBS_ML_APP; const apiKey = config.apiKey ?? process.env.DD_API_KEY; const site = config.site ?? process.env.DD_SITE ?? "datadoghq.com"; const env = config.env ?? process.env.DD_ENV; const envAgentless = process.env.DD_LLMOBS_AGENTLESS_ENABLED?.toLowerCase(); const agentless = config.agentless ?? (envAgentless === "true" || envAgentless === "1" ? true : false); if (!mlApp) { this.setDisabled(`Missing required mlApp. Set DD_LLMOBS_ML_APP environment variable or pass mlApp in config.`); this.config = config; return; } if (

Low

Ai Review Evidence

The exporter disables itself when required Datadog configuration is absent.

dist/index.jsView on unpkg · L316

package.jsonView file

Findings

2 High2 Medium3 Low

HighCopied Package Dependency Bridgedist/index.js

HighSemantic Analysis Limitedpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @mastra/datadog@1.4.7.

See all versions of @mastra/datadog for other recorded verdicts.

Review the evidence and your use of @mastra/datadog@1.4.7 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-12 00:40:39.788Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mastra

Behavioral surface

Source & flagged code

Related packages

More from @mastra