registry / @mastra/otel-exporter / 1.4.6

@mastra/otel-exporter@1.4.6

⚠ Under review

OpenTelemetry observability exporter for Mastra - supports OTLP traces and logs with multiple cloud providers

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 6 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 101 KB of source, external domains: api.lmnr.ai, api.traceloop.com, otlp.nr-data.net

Source & flagged code

1 flagged

dist/index.jsView file

Lines 53-93javascript

53const cache = /* @__PURE__ */ new Map();

54/**

55* Load a trace exporter for the given protocol.

56* Backward-compatible with existing usage in tracing.ts.

57*/

58async function loadExporter(protocol, provider) {

59 return loadSignalExporter("traces", protocol, provider);

60}

61/**

62* Load a signal-specific exporter class for the given protocol.

63* Returns the constructor, or null if the package isn't installed.

64*/

65async function loadSignalExporter(signal, protocol, provider) {

66 const spec = EXPORTER_SPECS[signal]?.[protocol];

67 if (!spec) {

68 if (protocol === "zipkin") console.warn(`[OtelExporter] Zipkin does not support OTLP ${signal}. ${capitalize(signal)} export will be disabled.`);

69 return null;

70 }

71 const cacheKey = `${signal}:${protocol}`;

72 if (cache.has(cacheKey)) return cache.get(cacheKey);

73 try {

74 const ExporterClass = (await import(spec.pkg))[spec.exportName];

75 if (typeof ExporterClass !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L73

76 console.error(`[OtelExporter] ${capitalize(signal)} ${protocol} exporter package "${spec.pkg}" did not expose a "${spec.exportName}" export. ${capitalize(signal)} export will be disabled.`);

77 return null;

78 }

79 cache.set(cacheKey, ExporterClass);

80 return ExporterClass;

81 } catch {

82 const providerInfo = provider ? ` (required for ${provider})` : "";

83 const allPkgs = [spec.pkg, ...spec.extras ?? []].join(" ");

84 console.error(`[OtelExporter] ${capitalize(signal)} ${protocol} exporter is not installed${providerInfo}.\n Install the required package(s):\n npm install ${allPkgs}`);

85 return null;

86 }

87}

88function capitalize(s) {

89 return s.charAt(0).toUpperCase() + s.slice(1);

90}

91//#endregion

92//#region src/log-converter.ts

93/**

Source & flagged code

1 flagged · loading source

dist/index.jsView file

73try { L74: const ExporterClass = (await import(spec.pkg))[spec.exportName]; L75: if (typeof ExporterClass !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L73

Findings

2 Medium4 Low

MediumDynamic Requiredist/index.js

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @mastra/otel-exporter@1.4.6.

See all versions of @mastra/otel-exporter for other recorded verdicts.

Review the evidence and your use of @mastra/otel-exporter@1.4.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 17:13:15.107Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mastra

Behavioral surface

Related packages

More from @mastra

Source & flagged code