Datadog Releases GuardDog 3.0 with YARA Rules, Risk Scoring and Sandboxing
Summary
GuardDog 3.0 adds YARA-based package scanning, an attack-chain risk score, and default sandboxing for npm and PyPI package analysis. Datadog also describes nightly evaluations using clustered malicious-package samples and labeled packages.
Key points
- GuardDog 3.0 replaces Semgrep source-code heuristics with YARA rules run through yara-python, citing performance and rule-coverage limitations.
- The scanner combines capability detections and threat indicators to identify potentially malicious activity in packages.
- Its risk score weighs maximum severity, attack-chain completeness, rule specificity, and sophistication; scores range from low risk to likely malicious.
- Package extraction and scanning run in a Nono sandbox that restricts network and filesystem access by default; a --no-sandbox option is available where Nono is unsupported.
- The sandbox addresses previously reported vulnerabilities that could have allowed crafted npm or PyPI packages to read or write files or achieve remote code execution on the scanning machine.
- Datadog evaluates the tool nightly using known-good and known-malicious packages, clustering malicious samples with TLSH to reduce near-duplicate bias.
- The article describes GuardDog as a static-analysis tool that does not execute scanned package code; it supports npm and PyPI packages and dependency manifests.
Article Details
- Event Type
- Release of GuardDog 3.0, an open-source package security scanning tool update.
- Impact
- Adds YARA-based source-code rules, risk scoring, and sandboxed package extraction and scanning to improve detection of malicious npm and PyPI packages and reduce risk to the machine running the scanner.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//github[.]com/DataDog/malicious-software-packages-dataset/blob/main/samples/pypi/compromised_lib/litellm/1.82.7/2026-03-24-litellm-v1.82.7.zip | Specific GitHub-hosted package URL presented as a malicious sample from the open-source malicious software packages dataset. |
Products
Tools
nono-pyBuilt-in sandboxing with nono-py for defense in depthSemgrepScanning with YARA instead of SemgrepYARAThen in August 2024 we introduced GuardDog 2.0 with support for custom rules, Golang modules, and YARA scanning.yara-pythonFor these reasons, we moved away from Semgrep and migrated our rules to YARA, which we run with yara-python.