
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
dd-trace: Node.js APM Tracer Library
dd-trace is an npm package that you can install in your Node.js application to capture APM (Application Performance Monitoring) data. In Datadog terminology this library is called a Tracer. This data is then sent off to a process which collects and aggregates the data, called an Agent. Finally the data is sent off to the Datadog servers where it's stored and made available for querying in a myriad of ways, such as displaying in a dashboard or triggering alerts.

Most of the documentation for dd-trace is available on these webpages:
| Release Line | Latest Version | Node.js | SSI | K8s Injection | Status | Initial Release | End of Life |
|---|---|---|---|---|---|---|---|
v1 | >= v12 | NO | NO | EOL | 2021-07-13 | 2022-02-25 | |
v2 | >= v12 | NO | NO | EOL | 2022-01-28 | 2023-08-15 | |
v3 | >= v14 | NO | YES | EOL | 2022-08-15 | 2024-05-15 | |
v4 | >= v16 | YES | YES | EOL | 2023-05-12 | 2025-01-11 | |
v5 | >= v18 | YES | YES | Current | 2024-01-11 | Unknown |
We currently maintain one release line, namely v5.
For any new projects it is recommended to use the v5 release line:
$ npm install dd-trace
$ yarn add dd-trace
Existing projects that need to use EOL versions of Node.js may continue to use these older release lines. This is done by specifying the version when installing the package.
$ npm install dd-trace@4 # or whatever version you need
$ yarn add dd-trace@4 # or whatever version you need
Note, however, that the end-of-life release lines are no longer maintained and will not receive updates.
Any backwards-breaking functionality that is introduced into the library will result in an increase of the major version of the library and therefore a new release line. Such releases are kept to a minimum to reduce the pain of upgrading the library.
When a new release line is introduced the previous release line then enters maintenance mode where it will receive updates for the next year. Once that year is up the release line enters End of Life and will not receive new updates. The library also follows the Node.js LTS lifecycle wherein new release lines drop compatibility with Node.js versions that reach end-of-life (with the maintenance release line still receiving updates for a year).
For more information about library versioning and compatibility, see the Node.js Compatibility Requirements page.
Changes associated with each individual release are documented on the GitHub Releases screen.
Please read the CONTRIBUTING.md document before contributing to this open source project.
ESM support requires an additional command line argument when starting the Node.js process. For more information, see the section on ESM support in the Node.js tracer documentation.
Note that there is a separate Lambda project, datadog-lambda-js, that is responsible for enabling metrics and distributed tracing when your application runs on Lambda.
That project does depend on the dd-trace package but also adds a lot of Lambda-related niceties.
If you find any issues specific to Lambda integrations then the issues may get solved quicker if they're added to that repository.
That said, even if your application runs on Lambda, any core instrumentation issues not related to Lambda itself may be better served by opening an issue in this repository.
Regardless of where you open the issue, someone at Datadog will try to help.
If you would like to trace your bundled application then please read this page on bundling and dd-trace. It includes information on how to use our ESBuild plugin and includes caveats for other bundlers.
Please refer to the SECURITY.md document if you have found a security issue.
Please refer to the Node.js Custom Instrumentation using OpenTelemetry API document. It includes information on how to use the OpenTelemetry API with dd-trace-js.
New Relic's APM tool is similar to dd-trace in that it provides performance monitoring and tracing for Node.js applications. It offers a wide range of features for monitoring application health and is known for its user-friendly interface. However, it is a different product with its own set of integrations and pricing model.
Elastic APM Node.js Agent is part of the Elastic APM suite, which integrates with the Elastic Stack (Elasticsearch, Kibana, etc.). It provides similar functionalities for monitoring Node.js applications, including distributed tracing and performance metrics. It is more focused on integration with the Elastic ecosystem.
Zipkin is an open-source distributed tracing system. It provides features to gather timing data needed to troubleshoot latency problems in service architectures. While it supports various programming languages, it requires more manual setup and configuration compared to dd-trace.
FAQs
Datadog APM tracing client for JavaScript
The npm package dd-trace receives a total of 3,545,646 weekly downloads. As such, dd-trace popularity was classified as popular.
We found that dd-trace demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.