registry / @mastra/datadog / 1.4.8
@mastra/datadog@1.4.8
Datadog LLM Observability exporter for Mastra - exports tracing data to Datadog's LLM Observability product
AI Security Review
scanned 15d ago · by lpm-firewall-aiInspected source aligns with the declared Datadog exporter purpose and uses direct dependencies and Datadog configuration. No install hook, unrelated destination, or concrete attack behavior was found.
Static reason
One or more suspicious static signals were detected.
Trigger
Application code imports and configures the exporter, then emits Mastra spans.
Impact
Configured Mastra tracing data is exported to Datadog; no independent malicious behavior was established.
Mechanism
It initializes dd-trace from supplied or Datadog environment configuration and forwards span details through the tracer's LLM observability API.
AI rationale
Inspected source aligns with the declared Datadog exporter purpose and uses direct dependencies and Datadog configuration. No install hook, unrelated destination, or concrete attack behavior was found.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json contains no install lifecycle hook and declares Datadog tracing dependencies.
- dist/index.js imports dd-trace and Mastra observability modules as direct runtime dependencies.
- The exporter reads Datadog configuration from caller config or DD_* environment variables, including a Datadog site default.
- Span export uses tracer.llmobs.trace and annotates the resulting Datadog span with Mastra span data.
Evidence against
Behavioral surface
EnvironmentVars
Source & flagged code
6 flagged · loading sourcedist/index.jsView file
2package = @mastra/datadog; repositoryIdentity = mastra; dependency = @mastra/observability
L2: import { omitKeys } from "@mastra/core/utils";
L3: import { BaseExporter, getExternalParentId } from "@mastra/observability";
L4: import tracer from "dd-trace";
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/index.jsView on unpkg · L21import { SpanType } from "@mastra/core/observability";
import { omitKeys } from "@mastra/core/utils";
import { BaseExporter, getExternalParentId } from "@mastra/observability";
import tracer from "dd-trace";
import { coreFeatures } from "@mastra/core
Low
Suspicious Dependency Evidence
dist/index.js imports dd-trace and Mastra observability modules as direct runtime dependencies.
dist/index.jsView on unpkg · L1316App ?? process.env.DD_LLMOBS_ML_APP;
const apiKey = config.apiKey ?? process.env.DD_API_KEY;
const site = config.site ?? process.env.DD_SITE ?? "datadoghq.com";
const env = config.env ?? process.env.DD_ENV;
const envAgentless = process.env.DD_LLMOBS_AGENTLESS_ENABLED?.toLowerCase();
const agentless = config.agentless ?? (envAgentless === "true" || envAgentless === "1" ? true : false);
if (!mlApp) {
this.setDisab
Findings
2 High2 Medium5 Low
HighCopied Package Dependency Bridgedist/index.js
HighSemantic Analysis Limitedpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Dependency Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @mastra/datadog@1.4.8.
See all versions of @mastra/datadog for other recorded verdicts.
- Review the evidence and your use of @mastra/datadog@1.4.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.