DataDog
diff --git a/‎packages/datadog-instrumentations/src/helpers/hooks.js‎
Lines changed: 2 additions & 0 deletions b/‎packages/datadog-instrumentations/src/helpers/hooks.js‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎packages/datadog-instrumentations/src/vm.js‎
Lines changed: 49 additions & 0 deletions b/‎packages/datadog-instrumentations/src/vm.js‎
Lines changed: 49 additions & 0 deletions
diff --git a/‎packages/dd-trace/src/appsec/iast/analyzers/code-injection-analyzer.js‎
Lines changed: 2 additions & 0 deletions b/‎packages/dd-trace/src/appsec/iast/analyzers/code-injection-analyzer.js‎
Lines changed: 2 additions & 0 deletions
@@ -97,6 +97,7 @@ module.exports = {
   'node:https': () => require('../http'),
   'node:net': () => require('../net'),
   'node:url': () => require('../url'),
+  'node:vm': () => require('../vm'),
   nyc: () => require('../nyc'),
   oracledb: () => require('../oracledb'),
   openai: () => require('../openai'),
@@ -123,6 +124,7 @@ module.exports = {
   undici: () => require('../undici'),
   url: () => require('../url'),
   vitest: { esmFirst: true, fn: () => require('../vitest') },
+  vm: () => require('../vm'),
   when: () => require('../when'),
   winston: () => require('../winston'),
   workerpool: () => require('../mocha')
 
@@ -0,0 +1,49 @@
+'use strict'
+
+const { channel, addHook } = require('./helpers/instrument')
+const shimmer = require('../../datadog-shimmer')
+const names = ['vm', 'node:vm']
+
+const runScriptStartChannel = channel('datadog:vm:run-script:start')
+const sourceTextModuleStartChannel = channel('datadog:vm:source-text-module:start')
+
+addHook({ name: names }, function (vm) {
+  vm.Script = class extends vm.Script {
+    constructor (code) {
+      super(...arguments)
+
+      if (runScriptStartChannel.hasSubscribers && code) {
+        runScriptStartChannel.publish({ code })
+      }
+    }
+  }
+
+  if (vm.SourceTextModule && typeof vm.SourceTextModule === 'function') {
+    vm.SourceTextModule = class extends vm.SourceTextModule {
+      constructor (code) {
+        super(...arguments)
+
+        if (sourceTextModuleStartChannel.hasSubscribers && code) {
+          sourceTextModuleStartChannel.publish({ code })
+        }
+      }
+    }
+  }
+
+  shimmer.wrap(vm, 'runInContext', wrapVMMethod)
+  shimmer.wrap(vm, 'runInNewContext', wrapVMMethod)
+  shimmer.wrap(vm, 'runInThisContext', wrapVMMethod)
+  shimmer.wrap(vm, 'compileFunction', wrapVMMethod)
+
+  return vm
+})
+
+function wrapVMMethod (original) {
+  return function wrappedVMMethod (code) {
+    if (runScriptStartChannel.hasSubscribers && code) {
+      runScriptStartChannel.publish({ code })
+    }
+
+    return original.apply(this, arguments)
+  }
+}
@@ -10,6 +10,8 @@ class CodeInjectionAnalyzer extends InjectionAnalyzer {
 
   onConfigure () {
     this.addSub('datadog:eval:call', ({ script }) => this.analyze(script))
+    this.addSub('datadog:vm:run-script:start', ({ code }) => this.analyze(code))
+    this.addSub('datadog:vm:source-text-module:start', ({ code }) => this.analyze(code))
   }
 
   _areRangesVulnerable () {
Original file line number	Diff line number	Diff line change
`@@ -10,6 +10,8 @@ class CodeInjectionAnalyzer extends InjectionAnalyzer {`
`10`	`10`
`11`	`11`	`onConfigure () {`
`12`	`12`	`this.addSub('datadog:eval:call', ({ script }) => this.analyze(script))`
	`13`	`+ this.addSub('datadog:vm:run-script:start', ({ code }) => this.analyze(code))`
	`14`	`+ this.addSub('datadog:vm:source-text-module:start', ({ code }) => this.analyze(code))`
`13`	`15`	`}`
`14`	`16`
`15`	`17`	`_areRangesVulnerable () {`