registry / datadog-cdk-constructs-v2 / 5.3.0
datadog-cdk-constructs-v2@5.3.0
⚠ Under reviewCDK Construct Library to automatically instrument Python and Node Lambda functions with Datadog using AWS CDK v2
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe inspected runtime code and manifest show no confirmed attack behavior. The compressed install-state artifact could not be inspected, so its role cannot be fully resolved and the package needs manual review.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
No install lifecycle hook is declared; the unresolved artifact’s behavior could not be determined.
Impact
No attack impact is confirmed; the unresolved artifact prevents a clean verdict.
Mechanism
Yarn source identifies `.yarn/install-state.gz` as its install-state file, but offline inspection of that artifact failed due to a buffer-size limit.
AI rationale
The inspected runtime code and manifest show no confirmed attack behavior. The compressed install-state artifact could not be inspected, so its role cannot be fully resolved and the package needs manual review.
Evidence
.yarn/install-state.gz.lpm-inspection-Hexaip/0-562eb04d6020.txt.yarn/releases/yarn-4.12.0.cjs
Decision evidence
public snapshotAI called this Manual Review at 89.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The offline analysis could not inspect `.yarn/install-state.gz` because of a buffer-size limit; Yarn identifies that path as its install-state file.
- The manifest lists build, development, and test scripts, with no install lifecycle hook.
- The Git helper is called by the Lambda construct and adds repository metadata to Lambda tags; no attack behavior was identified in that path.
Evidence against
- The package entrypoint re-exports library modules.
- The inspected Git helper reads the Git commit and remote, then uses those values to form Lambda tags.
Behavioral surface
ChildProcessCryptoEnvironmentVarsShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flagged.yarn/install-state.gzView file
•path = .yarn/install-state.gz
kind = high_entropy_blob
sizeBytes = 859011
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
.yarn/install-state.gzView on unpkg•path = .yarn/install-state.gz
kind = payload_in_excluded_dir
sizeBytes = 859011
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
.yarn/install-state.gzView on unpkg•path = .yarn/install-state.gz
kind = compressed_blob
sizeBytes = 859011
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
.yarn/install-state.gzView on unpkglib/env.js
Findings
3 High3 Medium6 Low
HighShips High Entropy Blob.yarn/install-state.gz
HighPayload In Excluded Dir.yarn/install-state.gz
HighPrevious Version Dangerous Deltalib/env.js
MediumEnvironment Vars
MediumShips Compressed Blob.yarn/install-state.gz
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidence.lpm-inspection-Hexaip/0-562eb04d6020.txt
LowAi Review Evidence.yarn/releases/yarn-4.12.0.cjs
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to datadog-cdk-constructs-v2@5.3.0.
See all versions of datadog-cdk-constructs-v2 for other recorded verdicts.
- Review the evidence and your use of datadog-cdk-constructs-v2@5.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.