cdktn-provider-azurerm

GHSA-698f-qxc2-w6p4

Malicious code in cdktn-provider-azurerm (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 17.0.0`

## Source: amazon-inspector (e647bdd78382c54b0565b5bde30513112aaebc17e80019da2ebfe1cfe3f9a14e)
Package name and branding closely mimic HashiCorp's legitimate cdktf-provider-azurerm (CDK for Terraform), with a single-character substitution (cdktf → cdktn) and fabricated 'CDK Terrain' branding at cdktn.io that mirrors HashiCorp's cdk.tf. PKG-INFO declares `Requires-Dist: cdktn<0.25.0,>=0.24.0`, forcing installation of a non-HashiCorp base package `cdktn` (analogue of the legitimate `cdktf`). The top-level module executes `import cdktn._jsii` at load time via src/cdktn_provider_azurerm/_jsii/__init__.py, so any code shipped in the attacker-controlled `cdktn` base runs in the installer's Python process the first time the provider is imported. README and metadata further reference `cdktn-io/cdktn-provider-azurerm` and a nonexistent `open-constructs/cdk-terrain` issue tracker, engineered to look identical to real HashiCorp CDKTF branding.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/4d04407622851020a568dac506f74c75f06fde04/osv/malicious/pypi/cdktn-provider-azurerm/MAL-2026-13606.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/4d04407622851020a568dac506f74c75f06fde04/osv/malicious/pypi/cdktn-provider-azurerm/MAL-2026-13606.json
- https://pypi.org/project/cdktn-provider-azurerm/17.0.0
- https://github.com/advisories/GHSA-698f-qxc2-w6p4

Compromised versions (1)

= 17.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.