datadog-cdk-constructs-v2@4.2.0
CDK Construct Library to automatically instrument Python and Node Lambda functions with Datadog using AWS CDK v2
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe package has no lifecycle execution, but it ships a directly executable sample with concrete privileged and persistent command behavior. This is a dangerous user-invoked capability rather than an install-time malware chain.
Decision evidence
public snapshot- lib/sample/ecs_fargate/index.js creates a setuid copy of bash at /tmp/malware.
- That sample installs curl/wget and runs an indefinite wget loop to https://google.com.
- The sample is shipped under lib/ and executes CDK synthesis on direct import.
- package.json has no preinstall, install, postinstall, or prepare hook.
- lib/index.js exports construct modules and does not import the sample.
- lib/env.js only invokes fixed git metadata commands and strips credentials from HTTPS remotes.
- The bundled Yarn release is not configured as yarnPath in .yarnrc.yml.
Source & flagged code
5 flaggedPackage ships high-entropy non-source blobs.
.yarn/install-state.gzView on unpkgPackage ships compressed or archive-like blobs.
.yarn/install-state.gzView on unpkgPackage hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
.yarn/releases/yarn-4.12.0.cjsFindings
Affected versions and remediation
This report applies to datadog-cdk-constructs-v2@4.2.0.
See all versions of datadog-cdk-constructs-v2 for other recorded verdicts.
- Review the evidence and your use of datadog-cdk-constructs-v2@4.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.