MAL-2026-13606
Malicious code in cdktn-provider-azurerm (PyPI)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (e647bdd78382c54b0565b5bde30513112aaebc17e80019da2ebfe1cfe3f9a14e) Package name and branding closely mimic HashiCorp's legitimate cdktf-provider-azurerm (CDK for Terraform), with a single-character substitution (cdktf → cdktn) and fabricated 'CDK Terrain' branding at cdktn.io that mirrors HashiCorp's cdk.tf. PKG-INFO declares `Requires-Dist: cdktn<0.25.0,>=0.24.0`, forcing installation of a non-HashiCorp base package `cdktn` (analogue of the legitimate `cdktf`). The top-level module executes `import cdktn._jsii` at load time via src/cdktn_provider_azurerm/_jsii/__init__.py, so any code shipped in the attacker-controlled `cdktn` base runs in the installer's Python process the first time the provider is imported. README and metadata further reference `cdktn-io/cdktn-provider-azurerm` and a nonexistent `open-constructs/cdk-terrain` issue tracker, engineered to look identical to real HashiCorp CDKTF branding.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for cdktn-provider-azurerm (pip). Pin to a known-safe version or switch to an alternative.