HackerOne: HackerOne Code: a live password reset token reaches Datadog RUM, and the same session records the account it unlocks

A password reset token was transmitted to a real user monitoring service before the reset form was submitted. The token was passed as a query string parameter in the URL and recorded by the monitoring SDK without any redaction. The same monitoring session also captured the account identifier afte...

MAL-2026-11850 Malicious code in @servicetitan/datadog-rum (npm)

npm/@servicetitan/datadog-rum is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malware in @servicetitan/datadog-rum

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

EUVD-2025-36843

Malicious code in bernie-plugin-datadog-rum npm...

MAL-2025-48988 Malicious code in bernie-plugin-datadog-rum (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0197846dec97a3a236eb5ede3d773adb5c175e3a2e0a497138424270d1610d9a The package bernie-plugin-datadog-rum was found to contain malicious code. Source: ghsa-malware...

Malicious code in bernie-plugin-datadog-rum (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0197846dec97a3a236eb5ede3d773adb5c175e3a2e0a497138424270d1610d9a The package bernie-plugin-datadog-rum was found to contain malicious code. Source: ghsa-malware...

Malware in bernie-plugin-datadog-rum

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview bernie-plugin-datadog-rum is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...