registry / @mastra/posthog / 1.4.3
@mastra/posthog@1.4.3
PostHog observability provider for Mastra
AI Security Review
scanned 2d ago · by lpm-firewall-aiInspected source shows a PostHog observability exporter with an expected configurable destination and event capture behavior. The package manifest has no install hook, and the inspected source establishes no unrelated credential transfer or other attack behavior.
Static reason
No blocking static signals were detected.
Trigger
Application code uses the provider and records observability events.
Impact
Observability data is sent to the configured PostHog destination; no unrelated credential transfer or other attack behavior was established.
Mechanism
The exporter uses the provided or environment API key with the configured PostHog host, then submits trace and feedback events through PostHog capture methods.
AI rationale
Inspected source shows a PostHog observability exporter with an expected configurable destination and event capture behavior. The package manifest has no install hook, and the inspected source establishes no unrelated credential transfer or other attack behavior.
Network endpoints1
us.i.posthog.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package manifest points to its runtime entrypoints and declares PostHog and Mastra observability dependencies; it has no install lifecycle hook.
- The exporter uses an explicitly supplied or environment-provided PostHog API key and supports a configurable PostHog host, defaulting to PostHog’s US service.
- The runtime sends tracing spans, call input, and feedback through PostHog capture methods as observability events.
- The inspected dependency entrypoints and exporter implementations are consistent with PostHog and Mastra observability functionality.
Evidence against
Behavioral surface
EnvironmentVars
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
2"name": "@mastra/posthog",
"version": "1.4.3",
"description": "PostHog observability provider for Mastra",
"type": "module",
"main": "dist/index.js",
"types": "dist/index.d.ts",
"files": [
"dist"
],
Low
Suspicious Lifecycle Evidence
The package manifest points to its runtime entrypoints and declares PostHog and Mastra observability dependencies; it has no install lifecycle hook.
package.jsonView on unpkg · L2dist/index.jsView file
62nfig = {}) {
const apiKey = config.apiKey ?? process.env.POSTHOG_API_KEY;
super({
...config,
apiKey
});
if (!apiKey) {
this.setDisabled("Missing required API key. Set POSTHOG_API_KEY environment variable or pass apiKey in config.");
return;
}
const clientConfig = this.buildClientConfig(this.config);
this.#client = new PostHog(apiKey, clientConfig);
const message = confi
Low
Ai Review Evidence
The exporter uses an explicitly supplied or environment-provided PostHog API key and supports a configurable PostHog host, defaulting to PostHog’s US service.
dist/index.jsView on unpkg · L6278
Findings
1 Medium11 Low
MediumEnvironment Vars
LowScripts Present
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowSuspicious Dependency Evidence.lpm-dependency-evidence-6d7e8d27-3cff-4873-ab16-1f2c48b54c22/0/npm-linux/package.json
LowSuspicious Dependency Evidence.lpm-dependency-evidence-6d7e8d27-3cff-4873-ab16-1f2c48b54c22/0/npm-linux/dist/entrypoints/index.node.js
LowSuspicious Dependency Evidence.lpm-dependency-evidence-6d7e8d27-3cff-4873-ab16-1f2c48b54c22/0/npm-linux/dist/entrypoints/index.node.mjs
LowSuspicious Dependency Evidence.lpm-dependency-evidence-6d7e8d27-3cff-4873-ab16-1f2c48b54c22/1/npm-linux/package.json
Affected versions and remediation
This report applies to @mastra/posthog@1.4.3.
See all versions of @mastra/posthog for other recorded verdicts.
- Review the evidence and your use of @mastra/posthog@1.4.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.