
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
@mastra/braintrust
Advanced tools
Affected versions:
Braintrust observability provider for Mastra - includes tracing and future observability features
Braintrust AI Observability exporter for Mastra applications.
npm install @mastra/braintrust
The exporter automatically reads credentials from environment variables:
# Required
BRAINTRUST_API_KEY=sk-...
# Optional
BRAINTRUST_ENDPOINT=https://api.braintrust.dev
import { BraintrustExporter } from '@mastra/braintrust';
const mastra = new Mastra({
...,
observability: {
configs: {
braintrust: {
serviceName: 'my-service',
exporters: [new BraintrustExporter()],
},
},
},
});
You can also pass credentials directly:
import { BraintrustExporter } from '@mastra/braintrust';
const mastra = new Mastra({
...,
observability: {
configs: {
braintrust: {
serviceName: 'my-service',
exporters: [
new BraintrustExporter({
apiKey: 'sk-...',
projectName: 'mastra-tracing', // Optional, defaults to 'mastra-tracing'
endpoint: 'https://api.braintrust.dev', // Optional
}),
],
},
},
},
});
| Option | Type | Description |
|---|---|---|
apiKey | string | Braintrust API key. Defaults to BRAINTRUST_API_KEY env var |
endpoint | string | Custom endpoint URL. Defaults to BRAINTRUST_ENDPOINT env var |
projectName | string | Project name. Defaults to 'mastra-tracing' |
braintrustLogger | Logger<true> | Optional Braintrust logger instance for context integration |
currentSpan | () => Span | undefined | Optional resolver from the app's Braintrust package instance |
tuningParameters | Record<string,any> | Support tuning parameters |
logger.traced() or Eval()When using Braintrust Eval() or logger.traced(), pass the currentSpan function from the same braintrust import that creates the eval or traced span. This lets Mastra attach traces to the active Braintrust span even when the app and @mastra/braintrust resolve different installed copies of the Braintrust SDK.
import { currentSpan, initLogger } from 'braintrust';
import { BraintrustExporter } from '@mastra/braintrust';
const logger = initLogger({
projectName: 'my-project',
apiKey: process.env.BRAINTRUST_API_KEY,
});
const exporter = new BraintrustExporter({
braintrustLogger: logger,
currentSpan,
});
FAQs
Braintrust observability provider for Mastra - includes tracing and future observability features
The npm package @mastra/braintrust receives a total of 31,300 weekly downloads. As such, @mastra/braintrust popularity was classified as popular.
We found that @mastra/braintrust demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.