Malicious Code Detected in nestjs-datadog: A Critical Security Alert
Summary
MAL-2025-6817: Malicious code in nestjs-datadog (npm). Affects nestjs-datadog versions 500.0.10 – 500.0.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nestjs-datadog is an npm package designed to facilitate integration with Datadog for monitoring and performance tracking in Node.js applications. It provides developers with tools to send metrics and logs to Datadog, enhancing observability. However, recent findings have revealed that certain versions of this package contain malicious code that compromises application security.
Vulnerability Detail
The vulnerability stems from the malicious version of the nestjs-datadog package, specifically versions 500.0.2 and 500.0.5. This package has been identified to communicate with a domain linked to malicious activities and execute commands associated with harmful behavior. The implications of this vulnerability include unauthorized access to sensitive data, potential data breaches, and the risk of further exploitation within the affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall nestjs-datadogIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the nestjs-datadog package from your project until a secure version is confirmed. Use the following command to uninstall it: 'npm uninstall nestjs-datadog'. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The discovery of malicious code in the nestjs-datadog package highlights the importance of vigilant package management and security practices. Users of affected versions should take immediate action to update or remove the package to safeguard their applications from potential threats.
See every vulnerability recorded for nestjs-datadog →
FAQ
Versions 500.0.2 and 500.0.5 of nestjs-datadog are identified as malicious.
You should immediately update to the latest version of nestjs-datadog or remove the package from your project.
You can use Vulert, which monitors your package-lock.json for vulnerabilities in real-time without requiring code access or installation.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without any signup.
Using a malicious package can lead to unauthorized access, data breaches, and exploitation of your application, potentially compromising user data and system integrity.
