datadog-cdk-constructs-v2
CDK Construct Library to automatically instrument Python and Node Lambda functions with Datadog using AWS CDK v2
This report shows the evidence for datadog-cdk-constructs-v2@5.4.0. 1 of 5 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe shipped ECS sample contains an unrelated setuid shell setup and recurring download loop, and wires that container into a Fargate service. The behavior is limited to deploying the sample; it does not run during package installation or import.
Decision evidence
public snapshot- The ECS Fargate sample defines a container as a dummy app for emitting CWS events and logs.
- That container copies bash to /tmp/malware, sets the setuid bit, installs curl and wget, then repeatedly downloads from google.com.
- The sample creates a Fargate service using the task definition containing that container.
- The package manifest declares no install lifecycle scripts.
- The package entry point re-exports library modules and does not import the ECS Fargate sample.
Source & flagged code
7 flaggedPackage ships high-entropy non-source blobs.
.yarn/install-state.gzView on unpkgPackage hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
.yarn/install-state.gzView on unpkgPackage ships compressed or archive-like blobs.
.yarn/install-state.gzView on unpkgFindings
Affected versions and remediation
This report applies to datadog-cdk-constructs-v2@5.4.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing datadog-cdk-constructs-v2@5.4.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.