# Introducing GuardDog 3.0: A new rules engine, transparent sandboxing, and more

DevFeed: [Introducing GuardDog 3.0: A new rules engine, transparent sandboxing, and more](<https://devfeed.tech/articles/introducing-guarddog-3-0-a-new-rules-engine-transparent-sandboxing-and-more-8288.md>)

Original publisher: [Read original article](<https://securitylabs.datadoghq.com/articles/guarddog-3-0-release/>)

Author: Christophe Tafani-Dereeper, Sebastian Obregoso

Published: 2026-06-26T00:00:00Z

Content type: release

Language: en

Sources: [Datadog Security Labs](<https://devfeed.tech/sources/datadog-security-labs.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Python](<https://devfeed.tech/topics/python.md>), [Code](<https://devfeed.tech/topics/code.md>), [Script](<https://devfeed.tech/topics/script.md>), [npm](<https://devfeed.tech/topics/npm.md>), [Process](<https://devfeed.tech/topics/process.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>), [JSON](<https://devfeed.tech/topics/json.md>)

Tags: [cli](<https://devfeed.tech/tags/cli.md>), [code](<https://devfeed.tech/tags/code.md>), [malware](<https://devfeed.tech/tags/malware.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [process](<https://devfeed.tech/tags/process.md>), [python](<https://devfeed.tech/tags/python.md>), [release](<https://devfeed.tech/tags/release.md>), [tool](<https://devfeed.tech/tags/tool.md>)

## AI overview

GuardDog 3.0 is an open-source tool for identifying malicious PyPI and npm packages. The release replaces Semgrep-based scanning with YARA rules run through yara-python, and introduces a risk engine that correlates weak signals to assess whether packages are likely malicious or benign. It also addresses scale and detection challenges involving package metadata, execution vectors, and credential access.

## Source excerpt

Release of GuardDog 3.0, an open-source tool to identify malicious packages, featuring a new YARA-based rules engine, a risk scoring engine, and built-in sandboxing.