# DataDog/guarddog

:snake: :mag: GuardDog is a CLI tool to Identify malicious PyPI and npm packages

Repository: https://github.com/DataDog/guarddog
Canonical: https://ross.abutalabs.com/products/guarddog
Homepage: https://securitylabs.datadoghq.com/articles/guarddog-identify-malicious-pypi-packages/
Language: Python
License: Apache-2.0
License Family: permissive
Topics: malicious-packages, pypi-packages, python, python-security, software-supply-chain-security, npm, npm-packages
Last push: 2026-09-02T03:49:30+00:00

## Health v2 (maintenance only)
Score: 99/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 100, release rhythm 97, longevity 100
- inputs: {"age_days": 1541, "days_push": 0, "days_rel": 21, "gap_med": 21, "n_releases_24m": 22}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1194, forks 121 (observed 2026-09-03T02:15:05.441508+00:00)

## What it is
GuardDog is a CLI tool from Datadog that identifies malicious packages on PyPI, npm, Go modules, Rust crates, RubyGems, GitHub Actions, and VSCode extensions. It combines YARA-based static analysis with package metadata heuristics and a risk-correlation model that scores findings based on attack chains.

## Use cases
- scan pypi packages for malware
- detect malicious npm packages before installing
- audit dependencies for supply chain attacks
- check if a package is a typosquat
- scan rust crates and rubygems for malicious code
- integrate malicious package scanning into CI

## When to choose
- you want to vet open-source dependencies for malicious behavior before adding them
- you need multi-ecosystem coverage (npm, PyPI, Go, Rust, RubyGems) in one tool
- you want risk-scored findings instead of raw pattern matches to reduce alert fatigue

## When to avoid
- you need runtime or dynamic analysis of package behavior
- you need full SAST vulnerability scanning (CVEs) rather than malicious-package detection
- you need a managed commercial supply-chain security platform with policy enforcement

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, vulnerability-scanning, cli, developer-tools
- domain: security, developer-tools, crawlers
- platform: python, cli, cross-platform
- tags: supply-chain-security, malicious-packages, pypi, npm, static-analysis, yara, package-scanning, dependency-audit

## Member repositories
- DataDog/guarddog (main) score 99

## Provenance
- Observed fields: from GitHub, fetched 2026-09-03T02:15:05.441508+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:22:39.495246+00:00, confidence not recorded.
  - readme: https://github.com/DataDog/guarddog (fetched 2026-09-03T02:15:05.441508+00:00, sha 0428757826ff)
  - homepage: https://securitylabs.datadoghq.com/articles/guarddog-identify-malicious-pypi-packages/ (fetched 2026-08-29T12:30:08.497627+00:00, sha ac36ceca78d3)
  - site_page: https://securitylabs.datadoghq.com/about (fetched 2026-08-29T12:30:08.500664+00:00, sha 6fe6e638ca74)
  - registry_pypi: https://pypi.org/pypi/guarddog/json (fetched 2026-08-29T12:30:08.502736+00:00, sha 4a5d45dc636b)
- Data as of 2026-08-30T08:39:29.467469+00:00.