datadog-cdk-constructs-v2@5.4.0
CDK Construct Library to automatically instrument Python and Node Lambda functions with Datadog using AWS CDK v2
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe shipped ECS sample contains an unrelated setuid shell setup and recurring download loop, and wires that container into a Fargate service. The behavior is limited to deploying the sample; it does not run during package installation or import.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user deploys the ECS Fargate sample stack.
Impact
The deployed container gains a privileged shell binary and generates recurring outbound traffic.
Mechanism
The container entry point copies /usr/bin/bash to /tmp/malware, sets its setuid bit, installs download tools, and loops while requesting https://google.com.
Attack narrative
If deployed, the ECS sample runs a container command that creates a setuid copy of bash and repeatedly downloads from google.com. This behavior is unrelated to a dummy telemetry app and exposes users who deploy the sample to a privileged shell in that container.
AI rationale
The shipped ECS sample contains an unrelated setuid shell setup and recurring download loop, and wires that container into a Fargate service. The behavior is limited to deploying the sample; it does not run during package installation or import.
Evidence
lib/sample/ecs_fargate/index.js/tmp/malware
Network endpoints1
google.com
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- The ECS Fargate sample defines a container as a dummy app for emitting CWS events and logs.
- That container copies bash to /tmp/malware, sets the setuid bit, installs curl and wget, then repeatedly downloads from google.com.
- The sample creates a Fargate service using the task definition containing that container.
Evidence against
- The package manifest declares no install lifecycle scripts.
- The package entry point re-exports library modules and does not import the ECS Fargate sample.
Behavioral surface
ChildProcessCryptoEnvironmentVarsShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flagged.yarn/install-state.gzView file
•path = .yarn/install-state.gz
kind = high_entropy_blob
sizeBytes = 860114
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
.yarn/install-state.gzView on unpkg•path = .yarn/install-state.gz
kind = payload_in_excluded_dir
sizeBytes = 860114
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
.yarn/install-state.gzView on unpkg•path = .yarn/install-state.gz
kind = compressed_blob
sizeBytes = 860114
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
.yarn/install-state.gzView on unpkglib/env.js
Findings
6 High3 Medium3 Low
HighShips High Entropy Blob.yarn/install-state.gz
HighPayload In Excluded Dir.yarn/install-state.gz
HighPrevious Version Dangerous Deltalib/env.js
HighAi Review Evidencelib/sample/ecs_fargate/index.js
HighAi Review Evidencelib/sample/ecs_fargate/index.js
HighAi Review Evidencelib/sample/ecs_fargate/index.js
MediumEnvironment Vars
MediumShips Compressed Blob.yarn/install-state.gz
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to datadog-cdk-constructs-v2@5.4.0.
See all versions of datadog-cdk-constructs-v2 for other recorded verdicts.
- Avoid installing datadog-cdk-constructs-v2@5.4.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.