Worm compromises hundreds of popular npm packages | Datadog Security Labs

On August 4, 2026, several popular npm packages, including 'keyv', were compromised to deliver malware.

securitylabs.datadoghq.com

Compromised AsyncAPI npm packages: inside a CI supply-chain attack | Datadog Security Labs

On July 14, 2026, four npm packages in the @asyncapi namespace, totaling over 3 million weekly downloads, were compromised to deliver credential-stealing malware. We investigate how the attack unfolde...

securitylabs.datadoghq.com

Not-so-anonymous telemetry: The @injectivelabs/sdk-ts backdoor | Datadog Security Labs

A malicious commit disguised as SDK telemetry briefly compromised @injectivelabs/sdk-ts, exfiltrating wallet mnemonics and private keys.

securitylabs.datadoghq.com

Coordinated GitHub API enumeration and access token abuse | Datadog Security Labs

Datadog Security Research has tracked multiple coordinated campaigns enumerating GitHub organizations, repositories, and users through the public GitHub API, abusing leaked access tokens, and cloning ...

securitylabs.datadoghq.com

Behind the console: An AiTM phishing kit harvesting AWS console credentials and beyond | Datadog Security Labs

Datadog Security Research investigates a June 2026 adversary-in-the-middle phishing campaign that cloned the AWS console login page to harvest victim credentials and multi-factor authentication codes.

securitylabs.datadoghq.com

Mapping out your unknown: A threat hunter’s guide to Salesforce | Datadog Security Labs

In this post, we walk through different threats to Salesforce and how to detect them.

securitylabs.datadoghq.com

Detecting the Klue supply chain attack in Salesforce instances | Datadog Security Labs

We summarize the Klue supply chain attack and provide detection guidance for Salesforce environments monitored by Datadog Cloud SIEM.

securitylabs.datadoghq.com

Entra Agent ID: Inside a cross-tenant agent compromise | Datadog Security Labs

Continuing our Agent ID series, this post demonstrates how a privileged agent could be compromised through its third-party blueprint. This leads to a cross-tenant incident similar to Midnight Blizzard...

securitylabs.datadoghq.com

Holding blobs for ransom: Four methods for Azure Storage ransomware | Datadog Security Labs

This post explores four vectors for threat actors to abuse Azure Storage to maliciously encrypt victim blobs, including step-by-step explanations and event codes for detection.

securitylabs.datadoghq.com

Entra Agent ID: The blueprint blast radius | Datadog Security Labs

Entra Agent ID is an extension of Entra's application model that provides identities for AI agents. Unlike applications, the agent identity model allows linking a single app registration (blueprint) t...

securitylabs.datadoghq.com

Scaling malicious code detection from pull requests to the software supply chain | Datadog

Datadog scaled malicious code detection from pull requests to dependency packages using stacked LLM evaluations and agentic investigation.

datadoghq.com

Malicious AI skills, compromised npm packages, and 100+ intentionally vulnerable AWS environments | Datadog Security Labs

This month's edition covers supply-chain attacks on npm packages and GitHub repositories, the release of Pathfinding Labs (100+ intentionally vulnerable AWS environments), and research on malicious AI...

securitylabs.datadoghq.com

GitHub - DataDog/IDE-SHEPHERD-extension: A VS Code/Cursor extension capable of performing realtime security monitoring from inside the IDE

A VS Code/Cursor extension capable of performing realtime security monitoring from inside the IDE - DataDog/IDE-SHEPHERD-extension

github.com

Compromised axios npm package delivers cross-platform RAT | Datadog Security Labs

An attacker hijacked an axios maintainer's npm account to publish malicious releases that deliver a cross-platform RAT.

securitylabs.datadoghq.com

When an AI agent came knocking: Catching malicious contributions in Datadog’s open source repos | Datadog

Learn how Datadog detected and resolved issues from hackerbot-claw, an AI-powered automated attack campaign.

datadoghq.com

Behind the console: Active phishing campaign targeting AWS console credentials | Datadog Security Labs

Datadog Security Research identified an active adversary-in-the-middle (AiTM) phishing campaign targeting AWS Console credentials via typosquatted domains that mimic AWS infrastructure.

securitylabs.datadoghq.com

Hook, line, and vault: A technical deep dive into the 1Phish kit | Datadog Security Labs

We analyze the evolution of the 1Phish phishing kit from a basic credential harvester into an MFA-aware, multi-stage phishing kit targeting 1Password users.

securitylabs.datadoghq.com

Tech impersonators: ClickFix and MacOS infostealers | Datadog Security Labs

Datadog identified an active campaign employing fake GitHub repositories impersonating software companies and leveraging the ClickFix initial access technique to deliver macOS infostealers.

securitylabs.datadoghq.com

Introducing IDE-SHEPHERD: Your shield against threat actors lurking in your IDE | Datadog Security Labs

IDE-SHEPHERD is an open-source IDE security extension that provides real-time monitoring and protection for VS Code and Cursor. It intercepts malicious process executions, monitors network activity, a...

securitylabs.datadoghq.com

Decoding the GitHub recommendations for npm maintainers | Datadog Security Labs

This blog post explores the rationale and implementation behind GitHub's security recommendations for npm maintainers following numerous high-profile supply-chain incidents. It details how hardening p...

securitylabs.datadoghq.com

2025 threat reports, Kubernetes version adoption, and how attackers use AI | Datadog Security Labs

This edition covers 2025 threat reports, Kubernetes version adoption, and how attackers use AI

securitylabs.datadoghq.com

MUT-4831: Trojanized npm packages deliver Vidar infostealer malware | Datadog Security Labs

Analysis of a threat actor campaign targeting Windows users with Vidar infostealer malware via malicious npm packages

securitylabs.datadoghq.com