TLDR Tech / InfoSec
Introducing GuardDog 3.0: A new rules engine, transparent sandboxing, and more
Datadog released GuardDog 3.0, its open source scanner for malicious PyPI and npm packages, replacing Semgrep with YARA rules run via yara-python for faster, less memory-hungry scans. The new risk engine correlates capability and threat-indicator rules across the attack lifecycle into a 0-10 score, benchmarked at 89.2% precision and 88.3% recall against a TLSH-deduplicated sample of Datadog's 27k-package malicious dataset. Scanning now runs inside a Nono sandbox by default (disable with --no-sandbox), limiting filesystem and network access even if a crafted package exploits GuardDog itself.
Read the full story