diff --git a/packages/dd-trace/src/appsec/sdk/track_event.js b/packages/dd-trace/src/appsec/sdk/track_event.js
index ea89ef79bb3..a04f596bbc3 100644
--- a/packages/dd-trace/src/appsec/sdk/track_event.js
+++ b/packages/dd-trace/src/appsec/sdk/track_event.js
@@ -26,7 +26,7 @@ function trackUserLoginSuccessEvent (tracer, user, metadata) {
 
   const login = user.login ?? user.id
 
-  metadata = Object.assign({ 'usr.login': login }, metadata)
+  metadata = { 'usr.login': login, ...metadata }
 
   trackEvent('users.login.success', metadata, 'trackUserLoginSuccessEvent', rootSpan)