{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "PKG-INFO",
              "sha256": "f4d459ba8476f82d23c38a2930aea087671ba083c68256d2757e41b0d46480eb",
              "tlsh": "aaa141b7c89089a05f620de0bc8baac8f72f215d589c90d898a7c475f263df2877e055"
            },
            {
              "path": "README.md",
              "sha256": "4f5f05fdc0b4cea7626c2d8e6cceb70e8ad0dfc96dd255522b976929dc34e2cd",
              "tlsh": "32710ebbc82089619f610de07cc7a9c8f76f309d54a8a1d9849bc870b277cf6477b091"
            }
          ],
          "package_integrity": [
            {
              "filename": "cdktn_provider_azurerm-17.0.0-py3-none-any.whl",
              "hashes": {
                "blake2b_256": "75a526033c4cad7530d1314502b81bccce432cd65d5041923dbc811e082d5b6c",
                "md5": "f7a765175b0372eee0f4e8a40d499587",
                "sha256": "c3ae5e82028d9ba9157a9ec7ff8b91407d044cf81147ab7cd397dffa6c32fb0e"
              }
            },
            {
              "filename": "cdktn_provider_azurerm-17.0.0.tar.gz",
              "hashes": {
                "blake2b_256": "f7abf0c0a70a41ac8e87cec535433b9310256ced7427e1544d47b0924ae13ad1",
                "md5": "524ce22c1bcf3080235f5e3ac1cc7101",
                "sha256": "131663a89a726fe804e01c3c5bde63be977dbcb09e9f06efbec6d776732ab7fe"
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "cdktn-provider-azurerm"
      },
      "versions": [
        "17.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-017051",
        "import_time": "2026-08-07T12:51:24.011415058Z",
        "modified_time": "2026-08-07T12:36:48Z",
        "sha256": "e647bdd78382c54b0565b5bde30513112aaebc17e80019da2ebfe1cfe3f9a14e",
        "source": "amazon-inspector",
        "versions": [
          "17.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e647bdd78382c54b0565b5bde30513112aaebc17e80019da2ebfe1cfe3f9a14e)\nPackage name and branding closely mimic HashiCorp\u0027s legitimate cdktf-provider-azurerm (CDK for Terraform), with a single-character substitution (cdktf \u2192 cdktn) and fabricated \u0027CDK Terrain\u0027 branding at cdktn.io that mirrors HashiCorp\u0027s cdk.tf. PKG-INFO declares `Requires-Dist: cdktn\u003c0.25.0,\u003e=0.24.0`, forcing installation of a non-HashiCorp base package `cdktn` (analogue of the legitimate `cdktf`). The top-level module executes `import cdktn._jsii` at load time via src/cdktn_provider_azurerm/_jsii/__init__.py, so any code shipped in the attacker-controlled `cdktn` base runs in the installer\u0027s Python process the first time the provider is imported. README and metadata further reference `cdktn-io/cdktn-provider-azurerm` and a nonexistent `open-constructs/cdk-terrain` issue tracker, engineered to look identical to real HashiCorp CDKTF branding.\n",
  "id": "MAL-2026-13606",
  "modified": "2026-08-07T12:36:48Z",
  "published": "2026-08-07T12:36:48Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/cdktn-provider-azurerm/17.0.0/"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in cdktn-provider-azurerm (PyPI)"
}