Malicious Code Detected in datadog-checks-base Package - Version 50.0.0
Summary
MAL-2025-192361: Malicious code in datadog-checks-base (npm). Affects datadog-checks-base versions 50.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'datadog-checks-base' package is a library used in Node.js applications for integrating with Datadog's monitoring and analytics platform. It provides various checks to monitor application performance and health. However, version 50.0.0 has been flagged for malicious behavior, raising concerns about its integrity and security.
Vulnerability Detail
The vulnerability in 'datadog-checks-base' version 50.0.0 is classified as malicious due to its communication with a domain linked to harmful activities and the execution of commands that may compromise system security. This behavior poses significant risks, including unauthorized access to sensitive data and potential system exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall datadog-checks-baseIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can remove the 'datadog-checks-base' package from your project until a secure version is confirmed. Use the following command to uninstall it: npm uninstall datadog-checks-base.
Conclusion
The 'datadog-checks-base' package version 50.0.0 has been identified as malicious, posing significant security risks. It is crucial to update or remove the package to protect your application from potential threats. Utilize tools like Vulert for ongoing monitoring of vulnerabilities in your software.
See every vulnerability recorded for datadog-checks-base →
FAQ
The package communicates with a domain associated with malicious activities and executes commands that can compromise system security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
If an immediate update is not possible, consider removing the package from your project as a temporary workaround until a secure version is available.
Detailed information can be found in the OpenSSF Package Analysis report and the official GitHub repository for 'datadog-checks-base'.
Uninstalling the package should not cause data loss, but ensure that your application does not rely on its functionality before removal.
