dd-trace

Datadog APM tracing client for JavaScript

Latest 6.20.1

NPM

91%

Total Score

healthy

Active Datadog-backed maintenance and strong release hygiene outweigh a few workflow-audit concerns.

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

The audit found high-confidence template-injection findings in release workflows, medium-confidence bot-condition findings, and high-confidence ad hoc package installation; 3 of 33 workflows were not analyzed. No untrusted checkout or script-injection sink was reported, and only 2 of 271 action uses are unpinned, so this is a contained workflow-hygiene concern rather than a decisive health failure.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-56796 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. dd-trace is vulnerable to Denial of Service (DoS) in versions 5.29.0 - 5.112.0.	5.29.0 - 5.112.0	Medium
CVE-2026-50272 dd-trace is vulnerable to Uncontrolled Resource Consumption in versions 0.0.0 - 5.100.0.	0.0.0 - 5.100.0	High
AIKIDO-2026-961466 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. dd-trace is vulnerable to Cleartext Transmission of Sensitive Information in versions 5.88.0 - 5.106.0.	5.88.0 - 5.106.0	Medium
AIKIDO-2026-10530 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. dd-trace is vulnerable to Prototype Pollution in versions 2.11.0 - 5.96.0.	2.11.0 - 5.96.0	Medium