registry / @mastra/otel-exporter / 1.3.11

@mastra/otel-exporter@1.3.11

⚠ Under review

OpenTelemetry observability exporter for Mastra - supports OTLP traces and logs with multiple cloud providers

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 84.1 KB of source, external domains: api.lmnr.ai, api.traceloop.com, otlp.nr-data.net

Source & flagged code

2 flagged

dist/index.jsView file

Lines 51-91javascript

51const cache = /* @__PURE__ */ new Map();

52/**

53* Load a trace exporter for the given protocol.

54* Backward-compatible with existing usage in tracing.ts.

55*/

56async function loadExporter(protocol, provider) {

57 return loadSignalExporter("traces", protocol, provider);

58}

59/**

60* Load a signal-specific exporter class for the given protocol.

61* Returns the constructor, or null if the package isn't installed.

62*/

63async function loadSignalExporter(signal, protocol, provider) {

64 const spec = EXPORTER_SPECS[signal]?.[protocol];

65 if (!spec) {

66 if (protocol === "zipkin") console.warn(`[OtelExporter] Zipkin does not support OTLP ${signal}. ${capitalize(signal)} export will be disabled.`);

67 return null;

68 }

69 const cacheKey = `${signal}:${protocol}`;

70 if (cache.has(cacheKey)) return cache.get(cacheKey);

71 try {

72 const ExporterClass = (await import(spec.pkg))[spec.exportName];

73 if (typeof ExporterClass !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L71

74 console.error(`[OtelExporter] ${capitalize(signal)} ${protocol} exporter package "${spec.pkg}" did not expose a "${spec.exportName}" export. ${capitalize(signal)} export will be disabled.`);

75 return null;

76 }

77 cache.set(cacheKey, ExporterClass);

78 return ExporterClass;

79 } catch {

80 const providerInfo = provider ? ` (required for ${provider})` : "";

81 const allPkgs = [spec.pkg, ...spec.extras ?? []].join(" ");

82 console.error(`[OtelExporter] ${capitalize(signal)} ${protocol} exporter is not installed${providerInfo}.\n Install the required package(s):\n npm install ${allPkgs}`);

83 return null;

84 }

85}

86function capitalize(s) {

87 return s.charAt(0).toUpperCase() + s.slice(1);

88}

89//#endregion

90//#region src/log-converter.ts

91/**

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

Source & flagged code

2 flagged · loading source

dist/index.jsView file

71try { L72: const ExporterClass = (await import(spec.pkg))[spec.exportName]; L73: if (typeof ExporterClass !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L71

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

Findings

1 High2 Medium4 Low

HighSemantic Analysis Limitedpackage.json

MediumDynamic Requiredist/index.js

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @mastra/otel-exporter@1.3.11.

See all versions of @mastra/otel-exporter for other recorded verdicts.

Review the evidence and your use of @mastra/otel-exporter@1.3.11 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-17 18:07:05.770Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mastra

Behavioral surface

Related packages

More from @mastra

Source & flagged code