Datadog's LLM Pipeline Flags Malicious npm and PyPI Packages Within Minutes: Christophe Tafani-Dereeper and Julien Doutre at VB2026
Since early 2025, attackers have hijacked npm and PyPI packages used by thousands of developers, from the Shai-Hulud worms to the takeover of Axios.
Package maintainers face credential theft, vulnerable CI/CD workflows, social engineering and adversary-in-the-middle phishing. One compromised maintainer can push malware into countless pipelines.
Datadog has to protect more than 3,000 engineers who install packages every day. That pressure produced a detection system that now runs daily in production.
In their VB2026 talk, "I will find you and I will flag you: hunting malicious packages at scale", on Wednesday, October 14 at 11:25 a.m., Christophe Tafani-Dereeper and Julien Doutre show how it works.
Speakers:
- Christophe Tafani-Dereeper, Staff Cloud Security Researcher, Datadog
- Julien Doutre, Senior Software Engineer, Datadog
The pipeline has two stages. A fast, cheap model reviews the diff of every new package release. Anything suspicious goes to an agent with tools for metadata analysis, code-similarity matching and IOC extraction.
The talk also introduces GuardDog V3, a new open-source release with heuristics for compromised maintainer accounts and tampered CI/CD pipelines. It closes with a review of 2026's most damaging supply chain attacks and a look at the Axios blast radius.
The work feeds a community dataset of more than 22,000 malicious package samples that over 30 research papers have cited.
Christophe Tafani-Dereeper is a staff cloud security researcher at Datadog based in Switzerland. He maintains open-source projects including Stratus Red Team. He has spoken at DEF CON, KubeCon and Black Hat USA.
Julien Doutre is a senior software engineer at Datadog who specializes in software supply chain security. His work covers container image signing, provenance and AI-powered detection of supply chain attacks.
To go deeper on the topic, start here:
- Research: Datadog on scaling malicious code detection, which detects 95.5% of malicious packages for about 2.5 cents each.
- Tool: GuardDog 3.0, Datadog's open-source scanner, with YARA support and a 0 to 10 risk score.
- Research: Datadog's analysis of the compromised Axios package, a library with more than 100 million weekly downloads.
- Research: Datadog on the Shai-Hulud 2.0 npm worm, which compromised 796 packages.
- Dataset: Datadog's malicious software packages dataset on GitHub.
Every team that installs open-source packages will want to see how fast a compromise can be caught.
How quickly would your organization notice if a package it depends on shipped malware tonight?
2 points · 1 comment
Mentions
Datadog's LLM Pipeline Flags Malicious npm and PyPI Packages Within Minutes: Christophe Tafani-Dereeper and Julien Doutre at VB2026 Since early 2025, attackers have hijacked npm and PyPI packages used by thousands of developers, from the Shai-Hulud worms to the takeover of Axios. Package maintainers face credential theft, vulnerable CI/CD workflows, social engineering and adversary-in-the-middle phishing. One compromised maintainer can push malware into countless pipelines. Datadog has to protect more than 3,000 engineers who install packages every day. That pressure produced a detection system that now runs daily in production. In their VB2026 talk, "I will find you and I will flag you: hunting malicious packages at scale", on Wednesday, October 14 at 11:25 a.m., Christophe Tafani-Dereeper and Julien Doutre show how it works. Speakers: - Christophe Tafani-Dereeper, Staff Cloud Security Researcher, Datadog - Julien Doutre, Senior Software Engineer, Datadog The pipeline has two stages. A fast, cheap model reviews the diff of every new package release. Anything suspicious goes to an agent with tools for metadata analysis, code-similarity matching and IOC extraction. The talk also introduces GuardDog V3, a new open-source release with heuristics for compromised maintainer accounts and tampered CI/CD pipelines. It closes with a review of 2026's most damaging supply chain attacks and a look at the Axios blast radius. The work feeds a community dataset of more than 22,000 malicious package samples that over 30 research papers have cited. Christophe Tafani-Dereeper is a staff cloud security researcher at Datadog based in Switzerland. He maintains open-source projects including Stratus Red Team. He has spoken at DEF CON, KubeCon and Black Hat USA. Julien Doutre is a senior software engineer at Datadog who specializes in software supply chain security. His work covers container image signing, provenance and AI-powered detection of supply chain attacks. To go deeper on the topic, start here: - Research: Datadog on scaling malicious code detection, which detects 95.5% of malicious packages for about 2.5 cents each. - Tool: GuardDog 3.0, Datadog's open-source scanner, with YARA support and a 0 to 10 risk score. - Research: Datadog's analysis of the compromised Axios package, a library with more than 100 million weekly downloads. - Research: Datadog on the Shai-Hulud 2.0 npm worm, which compromised 796 packages. - Dataset: Datadog's malicious software packages dataset on GitHub. Every team that installs open-source packages will want to see how fast a compromise can be caught. How quickly would your organization notice if a package it depends on shipped malware tonight?