registry / @mastra/langsmith / 1.3.28
@mastra/langsmith@1.3.28
Langsmith observability provider for Mastra - includes tracing and future observability features
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe runtime entrypoint implements a LangSmith tracing exporter, and the API key is passed to the LangSmith client for its intended service. The manifest has no install lifecycle hook, and source inspection found no concrete attack behavior.
Static reason
No blocking static signals were detected.
Trigger
A consumer configures the exporter and its observability system processes spans or score events.
Impact
Configured trace inputs, outputs, metadata, and feedback are sent to LangSmith for observability; no unrelated destination or local data harvesting was identified.
Mechanism
The exporter uses a configured API key or LANGSMITH_API_KEY to create runs and submit trace data through the LangSmith client.
AI rationale
The runtime entrypoint implements a LangSmith tracing exporter, and the API key is passed to the LangSmith client for its intended service. The manifest has no install lifecycle hook, and source inspection found no concrete attack behavior.
Evidence
package.jsondist/index.js.lpm-dependency-evidence-68bef0c7-2228-4a61-9b82-6722ed94ef46/0/npm-linux/dist/_openapi_client/client.cjs
Network endpoints1
api.smith.langchain.com/
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exports a LangSmith observability provider and declares LangSmith as its runtime client dependency. Its scripts are build, test, and lint tasks; no install lifecycle hook is declared.
- The exporter reads its API key from explicit configuration or LANGSMITH_API_KEY. The bundled client uses LangSmith’s API endpoint and adds the key to its authentication header.
- When observability events are handled, the exporter creates LangSmith runs and sends trace inputs, outputs, metadata, and score feedback through the LangSmith client.
- The inspected client resource modules identify themselves as generated OpenAPI code; no package-specific shell execution, local credential harvesting, or unrelated recipient was found.
- The response helper parses JSON bodies with response.json() and returns the parsed value.
Evidence against
Behavioral surface
EnvironmentVars
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
59"scripts": {
"build": "tsdown --silent --config tsdown.config.ts",
"build:watch": "pnpm build --watch",
"test": "vitest run",
"test:watch": "vitest watch",
"lint": "oxlint --type-aware .",
"lint:fix": "oxlint --type-aware --
Low
Suspicious Lifecycle Evidence
The package exports a LangSmith observability provider and declares LangSmith as its runtime client dependency. Its scripts are build, test, and lint tasks; no install lifecycle hook is declared.
package.jsonView on unpkg · L59.lpm-dependency-evidence-68bef0c7-2228-4a61-9b82-6722ed94ef46/0/npm-linux/dist/_openapi_client/resources/online-evaluators.cjsView file
1"use strict";
// @ts-nocheck
// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
Obje
Low
Ai Review Evidence
The inspected client resource modules identify themselves as generated OpenAPI code; no package-specific shell execution, local credential harvesting, or unrelated recipient was found.
.lpm-dependency-evidence-68bef0c7-2228-4a61-9b82-6722ed94ef46/0/npm-linux/dist/_openapi_client/resources/online-evaluators.cjsFindings
1 Medium9 Low
MediumEnvironment Vars
LowScripts Present
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidence.lpm-dependency-evidence-68bef0c7-2228-4a61-9b82-6722ed94ef46/0/npm-linux/dist/_openapi_client/resources/online-evaluators.cjs
LowAi Review Evidence.lpm-dependency-evidence-68bef0c7-2228-4a61-9b82-6722ed94ef46/0/npm-linux/dist/_openapi_client/resources/threads.cjs
LowAi Review Evidence.lpm-dependency-evidence-68bef0c7-2228-4a61-9b82-6722ed94ef46/0/npm-linux/dist/_openapi_client/resources/traces.cjs
LowAi Review Evidence.lpm-dependency-evidence-68bef0c7-2228-4a61-9b82-6722ed94ef46/0/npm-linux/dist/_openapi_client/resources/annotation-queues/annotation-queues.cjs
LowAi Review Evidence.lpm-dependency-evidence-68bef0c7-2228-4a61-9b82-6722ed94ef46/0/npm-linux/dist/_openapi_client/resources/datasets/datasets.cjs
Low
Affected versions and remediation
This report applies to @mastra/langsmith@1.3.28.
See all versions of @mastra/langsmith for other recorded verdicts.
- Review the evidence and your use of @mastra/langsmith@1.3.28 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.