{"id":"MAL-2026-13606","summary":"Malicious code in cdktn-provider-azurerm (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e647bdd78382c54b0565b5bde30513112aaebc17e80019da2ebfe1cfe3f9a14e)\nPackage name and branding closely mimic HashiCorp's legitimate cdktf-provider-azurerm (CDK for Terraform), with a single-character substitution (cdktf → cdktn) and fabricated 'CDK Terrain' branding at cdktn.io that mirrors HashiCorp's cdk.tf. PKG-INFO declares `Requires-Dist: cdktn\u003c0.25.0,\u003e=0.24.0`, forcing installation of a non-HashiCorp base package `cdktn` (analogue of the legitimate `cdktf`). The top-level module executes `import cdktn._jsii` at load time via src/cdktn_provider_azurerm/_jsii/__init__.py, so any code shipped in the attacker-controlled `cdktn` base runs in the installer's Python process the first time the provider is imported. README and metadata further reference `cdktn-io/cdktn-provider-azurerm` and a nonexistent `open-constructs/cdk-terrain` issue tracker, engineered to look identical to real HashiCorp CDKTF branding.\n","modified":"2026-08-18T05:46:18.782250515Z","published":"2026-08-07T12:36:48Z","withdrawn":"2026-08-13T16:18:30.952342Z","database_specific":{"malicious-packages-origins":[{"versions":["17.0.0"],"id":"IN-MAL-2026-017051","import_time":"2026-08-07T12:51:24.011415058Z","modified_time":"2026-08-07T12:36:48Z","sha256":"e647bdd78382c54b0565b5bde30513112aaebc17e80019da2ebfe1cfe3f9a14e","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://pypi.org/project/cdktn-provider-azurerm/17.0.0/"}],"affected":[{"package":{"name":"cdktn-provider-azurerm","ecosystem":"PyPI","purl":"pkg:pypi/cdktn-provider-azurerm"},"versions":["17.0.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/pypi/cdktn-provider-azurerm/MAL-2026-13606.json","indicators":{"evidence_files":[{"tlsh":"aaa141b7c89089a05f620de0bc8baac8f72f215d589c90d898a7c475f263df2877e055","path":"PKG-INFO","sha256":"f4d459ba8476f82d23c38a2930aea087671ba083c68256d2757e41b0d46480eb"},{"sha256":"4f5f05fdc0b4cea7626c2d8e6cceb70e8ad0dfc96dd255522b976929dc34e2cd","tlsh":"32710ebbc82089619f610de07cc7a9c8f76f309d54a8a1d9849bc870b277cf6477b091","path":"README.md"}],"package_integrity":[{"filename":"cdktn_provider_azurerm-17.0.0-py3-none-any.whl","hashes":{"blake2b_256":"75a526033c4cad7530d1314502b81bccce432cd65d5041923dbc811e082d5b6c","md5":"f7a765175b0372eee0f4e8a40d499587","sha256":"c3ae5e82028d9ba9157a9ec7ff8b91407d044cf81147ab7cd397dffa6c32fb0e"}},{"filename":"cdktn_provider_azurerm-17.0.0.tar.gz","hashes":{"blake2b_256":"f7abf0c0a70a41ac8e87cec535433b9310256ced7427e1544d47b0924ae13ad1","md5":"524ce22c1bcf3080235f5e3ac1cc7101","sha256":"131663a89a726fe804e01c3c5bde63be977dbcb09e9f06efbec6d776732ab7fe"}}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}