@datadog/browser-rum — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

datadog

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	obfuscated-file:bundle/chunks/datadogProfiler-78ed247f92836525d58f-datadog-rum.js	AI (source-diff): Webpack-bundled chunk with readable identifiers; standard for this browser SDK.	ai	2026/06/02
source-diff	obfuscated-file:bundle/chunks/datadogRecorder-9be81a56cbb4556ddc67-datadog-rum.js	AI (source-diff): Webpack-bundled chunk with readable identifiers; standard for this browser SDK.	ai	2026/06/02
source-diff	obfuscated-file:bundle/chunks/recorder-19282efda1d9e1eef3f9-datadog-rum.js	AI (source-diff): Webpack-minified bundle chunk; standard for this browser SDK package.	ai	2026/06/02
source-diff	obfuscated-file:bundle/chunks/profiler-bc30b320156fe69ea36e-datadog-rum.js	AI (source-diff): Webpack-minified bundle chunk; standard for this browser SDK package.	ai	2026/06/02
source-diff	obfuscated-file:bundle/chunks/recorder-39406f3d442079d21cdf-datadog-rum.js	AI (source-diff): Standard webpack bundle output for browser SDK; stable pattern.	ai	2026/06/02
source-diff	net-exec-file:bundle/datadog-rum.js	AI (source-diff): RUM SDK uses fetch for telemetry; expected behavior.	ai	2026/06/02
source-diff	obfuscated-file:bundle/chunks/profiler-9bd21f35a9cd65fa00e7-datadog-rum.js	AI (source-diff): Standard webpack bundle output for browser SDK; stable pattern.	ai	2026/06/02
source-diff	obfuscated-file:bundle/chunks/profiler-d23800d76b7e9a1ce188-datadog-rum.js	AI (source-diff): Webpack chunk bundle for browser SDK profiler; minified output is expected.	ai	2026/06/01
source-diff	obfuscated-file:bundle/chunks/datadogProfiler-3b47f4371e6a567c5448-datadog-rum.js	AI (source-diff): Webpack-bundled browser SDK output; standard for this package.	ai	2026/06/01
source-diff	obfuscated-file:bundle/chunks/datadogRecorder-e89b0cb2cbbe9a504aca-datadog-rum.js	AI (source-diff): Webpack-bundled browser SDK output; standard for this package.	ai	2026/06/01
source-diff	obfuscated-file:bundle/datadog-rum.js	AI (source-diff): Main bundle file; minified output is expected for browser SDK.	ai	2026/06/01
source-diff	obfuscated-file:esm/domain/deflate/deflateWorker.js	AI (source-diff): Inline deflate worker blob; standard compression utility.	ai	2026/06/01
source-diff	source-size-tripled	AI (source-diff): Major version bump; size increase consistent with new features.	ai	2026/06/01
npm-metadata	no-description	AI (npm-metadata): Scoped Datadog package; missing description is cosmetic.	ai	2026/06/01
source-diff	obfuscated-file:bundle/chunks/recorder-0afe5efdaeff698f0452-datadog-rum.js	AI (source-diff): Webpack-bundled browser SDK chunk; minified output is expected for this package.	ai	2026/06/01
source-diff	obfuscated-file:bundle/chunks/profiler-19a87877d28040459dc4-datadog-rum.js	AI (source-diff): Webpack-bundled browser SDK chunk; minified output is expected for this package.	ai	2026/06/01
source-diff	obfuscated-file:bundle/chunks/profiler-0bb56131347c1251d11e-datadog-rum.js	AI (source-diff): Webpack-chunked bundle output for Datadog browser SDK; stable pattern across versions.	ai	2026/05/31
source-diff	obfuscated-file:bundle/chunks/recorder-5c776143985e64ec9945-datadog-rum.js	AI (source-diff): Webpack-chunked bundle output for Datadog browser SDK; stable pattern across versions.	ai	2026/05/31
source-diff	obfuscated-file:bundle/chunks/recorder-c03e8b7b19febac6d778-datadog-rum.js	AI (source-diff): Webpack-bundled browser SDK chunk; minified output is expected for this package.	ai	2026/05/30
source-diff	obfuscated-file:bundle/chunks/profiler-b4f10a6ea372978d5c54-datadog-rum.js	AI (source-diff): Webpack-bundled browser SDK chunk; minified output is expected for this package.	ai	2026/05/30
source-diff	obfuscated-file:bundle/chunks/profiler-e4aed81736e8868cb71c-datadog-rum.js	AI (source-diff): Webpack-bundled browser SDK chunk; minified output is expected for this package.	ai	2026/05/30
source-diff	obfuscated-file:bundle/chunks/recorder-dda69c261a4923f8ee06-datadog-rum.js	AI (source-diff): Webpack-bundled browser SDK chunk; minified output is expected for this package.	ai	2026/05/30
source-diff	large-new-source-files	AI (source-diff): Version jump from 6.29→6.31 with restructured bundle chunks; normal for this package.	ai	2026/05/29
source-diff	obfuscated-file:bundle/chunks/recorder-926b641c6ef51d09a378-datadog-rum.js	AI (source-diff): Webpack-bundled browser chunk; minification is expected for this package's bundle output.	ai	2026/05/29
source-diff	obfuscated-file:bundle/chunks/profiler-9f1c1103f1ef0aa98257-datadog-rum.js	AI (source-diff): Webpack-bundled browser chunk; minification is expected for this package's bundle output.	ai	2026/05/29
dependencies	unvetted-dep:@datadog/browser-rum-core	AI (dependencies): First-party Datadog monorepo sibling package; always published in lockstep with this package.	ai	2026/05/27

Versions (showing 20 of 20)

Version	Deps	Published
7.2.0	2 / 2	2026-05-28
7.1.0	2 / 2	2026-05-11
7.0.0	2 / 2	2026-04-30
6.33.0	2 / 2	2026-04-23
6.32.0	2 / 2	2026-03-26
6.31.0	2 / 2	2026-03-16
6.30.1	2 / 2	2026-03-04
6.29.0	2 / 2	2026-03-03
6.28.1	2 / 2	2026-02-25
6.28.0	2 / 2	2026-02-23
6.27.1	2 / 2	2026-02-13
6.27.0	2 / 2	2026-02-11
6.26.0	2 / 2	2026-01-28
6.25.4	2 / 2	2026-01-16
6.25.3	2 / 2	2026-01-09
6.25.2	2 / 2	2026-01-05
6.25.1	2 / 2	2025-12-19
6.25.0	2 / 2	2025-12-10
6.24.1	2 / 2	2025-11-19
6.24.0	2 / 2	2025-11-13

v7.2.0

3 findings

HIGH New obfuscated file: bundle/chunks/datadogProfiler-78ed247f92836525d58f-datadog-rum.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: bundle/chunks/datadogRecorder-9be81a56cbb4556ddc67-datadog-rum.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.1.0

5 findings

HIGH New obfuscated file: bundle/chunks/datadogProfiler-3b47f4371e6a567c5448-datadog-rum.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: bundle/chunks/datadogRecorder-e89b0cb2cbbe9a504aca-datadog-rum.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: bundle/datadog-rum.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: esm/domain/deflate/deflateWorker.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.33.0

5 findings

HIGH New obfuscated file: bundle/chunks/profiler-9bd21f35a9cd65fa00e7-datadog-rum.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: bundle/chunks/recorder-39406f3d442079d21cdf-datadog-rum.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: bundle/datadog-rum.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: bundle/datadog-rum.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.32.0

3 findings

HIGH New obfuscated file: bundle/chunks/profiler-bc30b320156fe69ea36e-datadog-rum.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: bundle/chunks/recorder-19282efda1d9e1eef3f9-datadog-rum.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.31.0

3 findings

HIGH New obfuscated file: bundle/chunks/profiler-9f1c1103f1ef0aa98257-datadog-rum.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: bundle/chunks/recorder-926b641c6ef51d09a378-datadog-rum.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.30.1

3 findings

HIGH New obfuscated file: bundle/chunks/profiler-0bb56131347c1251d11e-datadog-rum.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: bundle/chunks/recorder-5c776143985e64ec9945-datadog-rum.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.29.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.28.1

3 findings

HIGH New obfuscated file: bundle/chunks/profiler-0bb56131347c1251d11e-datadog-rum.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: bundle/chunks/recorder-5c776143985e64ec9945-datadog-rum.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.28.0

3 findings

HIGH New obfuscated file: bundle/chunks/profiler-d23800d76b7e9a1ce188-datadog-rum.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: bundle/chunks/recorder-5c776143985e64ec9945-datadog-rum.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.27.1

3 findings

HIGH New obfuscated file: bundle/chunks/profiler-19a87877d28040459dc4-datadog-rum.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: bundle/chunks/recorder-0afe5efdaeff698f0452-datadog-rum.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.27.0

3 findings

HIGH New obfuscated file: bundle/chunks/profiler-e4aed81736e8868cb71c-datadog-rum.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: bundle/chunks/recorder-dda69c261a4923f8ee06-datadog-rum.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.26.0

3 findings

HIGH New obfuscated file: bundle/chunks/profiler-b4f10a6ea372978d5c54-datadog-rum.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: bundle/chunks/recorder-c03e8b7b19febac6d778-datadog-rum.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.25.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.25.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.25.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.25.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.25.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.24.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.24.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.