dd-trace

Strong consumer documentation, TypeScript declarations, release notes, and build provenance support dependable adoption. The organization-backed project also has broad recent contributor activity, testing, security tooling, and a security policy.

Latest 6.19.0

NPM

94%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

100

Supply Chain

Attestations

100

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

The audit found no untrusted checkout or script-injection paths, and 25 workflows scope permissions at job level; however, 2 of 32 workflows were not analyzed and high-confidence template-injection findings remain hygiene concerns.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-56796 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. dd-trace is vulnerable to Denial of Service (DoS) in versions 5.29.0 - 5.112.0.	5.29.0 - 5.112.0	Medium
CVE-2026-50272 dd-trace is vulnerable to Uncontrolled Resource Consumption in versions 0.0.0 - 5.100.0.	0.0.0 - 5.100.0	High
AIKIDO-2026-961466 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. dd-trace is vulnerable to Cleartext Transmission of Sensitive Information in versions 5.88.0 - 5.106.0.	5.88.0 - 5.106.0	Medium
AIKIDO-2026-10530 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. dd-trace is vulnerable to Prototype Pollution in versions 2.11.0 - 5.96.0.	2.11.0 - 5.96.0	Medium