Trust Center

We are aware of a supply chain attack in which the npm maintainer account for jaredwray was compromised, resulting in ~1800+ malicious compromised package versions being published beginning August 4, 2026.

Upon learning of this activity, Datadog's security team investigated potential exposure across our products, public packages, customer-facing infrastructure, and internal development environments. One Datadog-published npm package, backstage-plugin-datadog-entity-sync-backend (versions 1.1.1, 1.1.2, 1.1.4, and 1.1.5), referenced a compromised package as a transitive dependency. We confirmed that Datadog was not impacted. As a precaution, we have blocked all known malicious package versions across our internal systems and continue to monitor for exposure.

This supply chain attack campaign involved a self-propagating worm that has continued to spread to maintainer accounts and packages beyond the initial set. We will update this post if the scope or our exposure assessment changes. We recommend checking the compromised package versions against your own dependencies. If you use the affected versions listed, review the potentially affected systems for the campaign's indicators of compromise.

For a detailed breakdown of the campaign and how to assess impact in your own environment, see our Security Labs post for the current authoritative list.

If you have any further questions, our Support team is here to help.

Summary

Datadog's security team was notified on June 18, 2026 of three vulnerabilities in Vector, the open-source data pipeline tool, reported by DeMarcus Campbell, Information Security at International Exchange, Inc. (ICE), through coordinated disclosure. Patches for all three issues are available in Vector v0.57.0, released on July 14, 2026. Our investigation found no evidence that these vulnerabilities were exploited in the wild or that any Datadog customer data was accessed or exfiltrated.

Advisory Details

Full technical details, including CVSS scores and affected version ranges, are available in the GitHub Security Advisories linked above.

Timeline

• June 18, 2026: Datadog notified of findings by International Exchange, Inc. (ICE).
• June 18, 2026: Coordinated disclosure process initiated with Vector engineering team.
• July 14, 2026: Patched version v0.57.0 was released; public advisory published July 14, 2026.

Vector is an open-source project and not a paid Datadog product; support is provided through public community channels (primarily GitHub Issues/Discussions), not Datadog Support.

If you have additional questions, reach out via your Customer Success Manager, Account Executive, or through Datadog Support.

We are aware of a supply chain attack in which four npm packages published by the AsyncAPI open source project, were compromised with malicious code on July 14, 2026:

• @asyncapi/generator
• @asyncapi/generator-helpers
• @asyncapi/generator-components
• @asyncapi/specs

Upon learning of this activity, Datadog's security team immediately investigated our potential exposure. As a result, we can confirm Datadog does not use any of the affected packages in our products or infrastructure. As an added precaution, we have blocked all known malicious versions of these packages, along with associated network infrastructure, across our internal systems.

For a detailed breakdown of the campaign and how you can assess impact in your own environment, refer to our Security Labs post.

If you have any further questions, our Support team is here to help.

What Happened

The domain dtdg.co (used to send certain Datadog notification emails, including Monitor Alerting notifications from alert@dtdg.co) was added to a small number of spam-reputation blocklists. This caused a subset of outbound emails from alert@dtdg.co to be silently rejected, dropped or marked as spam by recipient mail servers that consult these blocklists, without generating a bounce notification back to Datadog or to the sender.

This was an external deliverability issue, not a compromise of Datadog systems. We can confirm this incident did not involve unauthorized access to Datadog infrastructure, and no customer data was accessed or exposed as a result.

What Datadog Has Done To Address This Issue

Our team identified the root cause of dtdg.co being added to these blocklists. We engaged directly with the spam list providers to request delisting, and cleared the sending IPs that had been flagged. Email delivery from alert@dtdg.co has been restored, and we have validated that outbound notifications are again being delivered successfully.

Next Steps for Customers

• Check your notification history within Datadog for the affected window (approximately July 7th–July 9th) to confirm whether expected alert@dtdg.co notifications were received

• Confirm that dtdg.co is not independently blocklisted on your own mail infrastructure or spam-filtering tools, which could cause continued delivery issues on your end even though the upstream blocklisting has been resolved

• Add dtdg.co as part of your allowlist within your mail infrastructure

  • Note–customers using EU or Govcloud sites should consider adding dtdg.eu and/or ddgov-gov.com to this allow list 
     

• If email is your only configured notification channel for critical alerts, consider configuring a secondary notification channel (e.g., Slack, PagerDuty, webhook) as a resilience measure against future email-deliverability disruptions

Next Steps for Datadog

To reduce the risk of a similar disruption recurring, we have committed to the following near-term actions:

• Adding protection mechanisms to our email/alerting systems and product, to reduce the risk of alert/notification emails from being dropped, silently rejected or marked as spam

• Augmenting our email reputation monitoring infrastructure to more proactively detect if/when Datadog’s sending domains are still blocked

If you have any further questions, our Support team is here to help.