Published file metadata, source observations, indicators, and research history in one bounded catalog.
We investigate how a coordinated supply chain campaign that compromised npm and PyPI packages also backdoored the official Cemu Nintendo Wii U emulator GitHub release, reaching nearly 20,000 Linux users.
First reported May 14, 2026 00:00 UTCOpen evidence recordWe tested Sonnet 5, Composer 2.5, and GPT 5.5 in plan mode and default mode to see whether plan mode produces measurably more secure code.
First reported Aug 19, 2026 00:00 UTCOpen evidence recordWe analyzed RBAC bindings across over 65,000 Kubernetes clusters to find dangerous permissions granted to system:anonymous, system:unauthenticated, and system:authenticated.
First reported Oct 05, 2026 00:00 UTCOpen evidence recordDatadog Security Research has tracked multiple coordinated campaigns enumerating GitHub organizations, repositories, and users through the public GitHub API, abusing leaked access tokens, and cloning private repositories.
First reported Jul 08, 2026 00:00 UTCOpen evidence recordDatadog Security Labs discovered GHSA-632h-h47v-g4x4, a vulnerability in OpenCode's upgrade endpoint that, under certain conditions, allowed malicious webpages to execute code on developers' machines.
First reported Sep 24, 2026 00:00 UTCOpen evidence recordIn this post, we examine two vibe-coded credential harvesting platforms, Loot and UltraVault, and the Amazon Bedrock abuse used to validate stolen secrets.
First reported Sep 18, 2026 00:00 UTCOpen evidence recordRelease of GuardDog 3.0, an open-source tool to identify malicious packages, featuring a new YARA-based rules engine, a risk scoring engine, and built-in sandboxing.
First reported Jun 26, 2026 00:00 UTCOpen evidence recordDatadog Security Research executed a newer N4D Mesh Controller sample in isolated microVMs, uncovering rotated infrastructure, a UPX-packed go-titan agent, MCP tool abuse in action, and direct runtime evidence of multi-service scanning and persistence.
First reported Aug 20, 2026 00:00 UTCOpen evidence recordOn August 4, 2026, several popular npm packages, including 'keyv', were compromised to deliver malware.
First reported Aug 04, 2026 00:00 UTCOpen evidence recordCVE-2026-31431 (Copy Fail) lets any unprivileged user corrupt the Linux page cache via AF_ALG sockets to escalate privileges. This post covers the exploit mechanics and how Datadog Security Research used coding agents to ship a detection content pack in a single session.
First reported May 28, 2026 00:00 UTCOpen evidence recordA look at how Kubernetes CVE-2021-25740 allows users with EndpointSlice access to redirect traffic via shared ingress and load balancer services.
First reported May 21, 2026 00:00 UTCOpen evidence recordDatadog Security Research observed a password spraying campaign attempting to authenticate as the AWS root user across more than 150 organizations.
First reported Aug 31, 2026 00:00 UTCOpen evidence recordIn this post, we share LLM-specific validation patterns that attackers use to test exposed AWS credentials for Amazon Bedrock access.
First reported Oct 06, 2026 00:00 UTCOpen evidence recordOn July 14, 2026, four npm packages in the @asyncapi namespace, totaling over 3 million weekly downloads, were compromised to deliver credential-stealing malware. We investigate how the attack unfolded and how to know if you're affected.
First reported Jul 14, 2026 00:00 UTCOpen evidence recordA static analysis of the open-sourced Shai-Hulud offensive framework attributed to TeamPCP, covering its credential harvesting, supply chain poisoning, and exfiltration capabilities.
First reported May 13, 2026 00:00 UTCOpen evidence recordEntra Agent ID is an extension of Entra's application model that provides identities for AI agents. Unlike applications, the agent identity model allows linking a single app registration (blueprint) to multiple identities and their associated privileges, increasing the potential blast radius of a compromised agent.
First reported Jun 11, 2026 00:00 UTCOpen evidence recordIn this post, we walk through different threats to GitHub and how to detect them.
First reported Sep 16, 2026 00:00 UTCOpen evidence recordWe analyze how VoidLink, LinkPro, and Atomic Arch abuse eBPF helpers to hide from defenders, and show how to detect them at load time, before they can act.
First reported Jul 27, 2026 00:00 UTCOpen evidence recordAn analysis of backdoored node-ipc npm releases that add an obfuscated credential collection and DNS exfiltration payload to the CommonJS entrypoint.
First reported May 14, 2026 00:00 UTCOpen evidence recordSharing new scenarios and adaptations to play the Datadog expansion pack of Backdoors & Breaches.
First reported Jul 01, 2026 00:00 UTCOpen evidence recordGitHub Actions workflows are vulnerable to pwn requests, script injection, and compromised credentials. Here's what's going wrong and what's changing.
First reported Jun 02, 2026 00:00 UTCOpen evidence recordDatadog Security Research investigates a June 2026 adversary-in-the-middle phishing campaign that cloned the AWS console login page to harvest victim credentials and multi-factor authentication codes.
First reported Jun 24, 2026 00:00 UTCOpen evidence recordContinuing our Agent ID series, this post demonstrates how a privileged agent could be compromised through its third-party blueprint. This leads to a cross-tenant incident similar to Midnight Blizzard, since an attacker with control over an agent blueprint can authenticate as any agent associated with that blueprint.
First reported Jun 18, 2026 00:00 UTCOpen evidence recordWe summarize the Klue supply chain attack and provide detection guidance for Salesforce environments monitored by Datadog Cloud SIEM.
First reported Jun 22, 2026 00:00 UTCOpen evidence recordA filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.