datadog-cdk-constructs-v2@5.1.0
CDK Construct Library to automatically instrument Python and Node Lambda functions with Datadog using AWS CDK v2
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe sample contains concrete harmful shell behavior but is isolated from the exported entrypoint and requires explicit sample import plus deployment. This merits a warning for a staged payload carrier, not a publish block.
Decision evidence
public snapshot- Packaged ECS sample contains a shell command that creates a setuid `/tmp/malware`, installs tools, and loops wget requests.
- The sample synthesizes and deploys this task definition when its module is explicitly imported.
- This behavior is isolated under `lib/sample` and is not imported by the public entrypoint.
- package.json has no preinstall, install, or postinstall hook.
- Main package code has no HTTP/network client or filesystem-write primitive found.
- The normal construct code configures Datadog Lambda/ECS resources only after user invocation.
Source & flagged code
6 flaggedPackage ships high-entropy non-source blobs.
.yarn/install-state.gzView on unpkgPackage hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
.yarn/install-state.gzView on unpkgPackage ships compressed or archive-like blobs.
.yarn/install-state.gzView on unpkgFindings
Affected versions and remediation
This report applies to datadog-cdk-constructs-v2@5.1.0.
See all versions of datadog-cdk-constructs-v2 for other recorded verdicts.
- Review the evidence and your use of datadog-cdk-constructs-v2@5.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.