{"id":"MAL-2026-13606","title":"Malicious code in cdktn-provider-azurerm (PyPI)","summary":"Malicious code in cdktn-provider-azurerm (PyPI)","severity":"none","vendor":"cdktn-provider-azurerm","product":"cdktn-provider-azurerm","ecosystem":"pip","affected":["cdktn-provider-azurerm"],"published":"2026-08-07","updated":"2026-08-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-13606","references":[{"url":"https://pypi.org/project/cdktn-provider-azurerm/17.0.0/"}],"tags":["osv","pip"],"ingestedAt":"2026-08-07T19:14:15.258Z","slug":"MAL-2026-13606","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e647bdd78382c54b0565b5bde30513112aaebc17e80019da2ebfe1cfe3f9a14e)\nPackage name and branding closely mimic HashiCorp's legitimate cdktf-provider-azurerm (CDK for Terraform), with a single-character substitution (cdktf → cdktn) and fabricated 'CDK Terrain' branding at cdktn.io that mirrors HashiCorp's cdk.tf. PKG-INFO declares `Requires-Dist: cdktn<0.25.0,>=0.24.0`, forcing installation of a non-HashiCorp base package `cdktn` (analogue of the legitimate `cdktf`). The top-level module executes `import cdktn._jsii` at load time via src/cdktn_provider_azurerm/_jsii/__init__.py, so any code shipped in the attacker-controlled `cdktn` base runs in the installer's Python process the first time the provider is imported. README and metadata further reference `cdktn-io/cdktn-provider-azurerm` and a nonexistent `open-constructs/cdk-terrain` issue tracker, engineered to look identical to real HashiCorp CDKTF branding.\n\n\n## Affected packages\n\n- `cdktn-provider-azurerm`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}