Trust Center

We are aware of a supply chain attack in which the npm maintainer account for jaredwray was compromised, resulting in ~1800+ malicious compromised package versions being published beginning August 4, 2026.

Upon learning of this activity, Datadog's security team investigated potential exposure across our products, public packages, customer-facing infrastructure, and internal development environments. One Datadog-published npm package, backstage-plugin-datadog-entity-sync-backend (versions 1.1.1, 1.1.2, 1.1.4, and 1.1.5), referenced a compromised package as a transitive dependency. We confirmed that Datadog was not impacted. As a precaution, we have blocked all known malicious package versions across our internal systems and continue to monitor for exposure.

This supply chain attack campaign involved a self-propagating worm that has continued to spread to maintainer accounts and packages beyond the initial set. We will update this post if the scope or our exposure assessment changes. We recommend checking the compromised package versions against your own dependencies. If you use the affected versions listed, review the potentially affected systems for the campaign's indicators of compromise.

For a detailed breakdown of the campaign and how to assess impact in your own environment, see our Security Labs post for the current authoritative list.

If you have any further questions, our Support team is here to help.

Summary

Datadog's security team was notified on June 18, 2026 of three vulnerabilities in Vector, the open-source data pipeline tool, reported by DeMarcus Campbell, Information Security at International Exchange, Inc. (ICE), through coordinated disclosure. Patches for all three issues are available in Vector v0.57.0, released on July 14, 2026. Our investigation found no evidence that these vulnerabilities were exploited in the wild or that any Datadog customer data was accessed or exfiltrated.

Advisory Details

Full technical details, including CVSS scores and affected version ranges, are available in the GitHub Security Advisories linked above.

Timeline

• June 18, 2026: Datadog notified of findings by International Exchange, Inc. (ICE).
• June 18, 2026: Coordinated disclosure process initiated with Vector engineering team.
• July 14, 2026: Patched version v0.57.0 was released; public advisory published July 14, 2026.

Vector is an open-source project and not a paid Datadog product; support is provided through public community channels (primarily GitHub Issues/Discussions), not Datadog Support.

If you have additional questions, reach out via your Customer Success Manager, Account Executive, or through Datadog Support.

What Happened?

On October 19th, Datadog became aware that eight intermediate certificate authorities operated by eMudhra (emSign) had been compromised, as disclosed by Mozilla. As a result, certificates issued by these certificate authorities can no longer be trusted. The affected certificate authorities are:

• EM EV TLS CA - G3B
• EM OV TLS CA - G3B
• EM DV TLS CA - G3B
• EM EV TLS CA - G3C
• EM OV TLS CA - G3C
• EM DV TLS CA - G3C
• EM OV CS CA - G3B
• EM OV CS CA - G3C

Additional details are available in Mozilla's incident report. Please note–this CA compromise is impacting the industry writ large and is not a Datadog-specific issue. We are responding urgently, as outlined below.

What Has Datadog Done to Address This?

We have reviewed where the compromised certificate authorities are trusted across our customer-facing software and components, as well as our internal systems, and have begun updating our root stores to remove compromised certificates. We have not identified any impact to customer data as a result of our investigations at this time, but we will continue to monitor the situation as our remediation efforts continue.

What Do I Need to Do?

Out of an abundance of caution, please review your environment for Datadog software and components that you are running (e.g., the Datadog Agent) and upgrade to the latest version. Given the scale and impact of this ecosystem-wide issue, we are pushing updates rapidly and recommend customers upgrade as quickly as possible. 

If you have any further questions, our Support team is here to help.

We are pleased to announce that Datadog has achieved its first Cyber Essentials Plus (CE+) certification. CE+ is a UK Government-backed certification that independently verifies an organization's protections against common cyber threats.

The certification covers Datadog's UK operations, including the UK production environment, UK-based employees, their end-user devices and associated supporting infrastructure. All other Datadog networks, locations, and infrastructure are outside the certification scope.

We’re pleased to announce that summaries of the 2026 penetration tests for Datadog, Eppo, and Cloudcraft (performed by NCC Group) are available on our trust center. These summaries are accompanied by Letters of Engagement.