Source: amazon-inspector (e647bdd78382c54b0565b5bde30513112aaebc17e80019da2ebfe1cfe3f9a14e)
Package name and branding closely mimic HashiCorp's legitimate cdktf-provider-azurerm (CDK for Terraform), with a single-character substitution (cdktf → cdktn) and fabricated 'CDK Terrain' branding at cdktn.io that mirrors HashiCorp's cdk.tf. PKG-INFO declares Requires-Dist: cdktn<0.25.0,>=0.24.0, forcing installation of a non-HashiCorp base package cdktn (analogue of the legitimate cdktf). The top-level module executes import cdktn._jsii at load time via src/cdktn_provider_azurerm/_jsii/init.py, so any code shipped in the attacker-controlled cdktn base runs in the installer's Python process the first time the provider is imported. README and metadata further reference cdktn-io/cdktn-provider-azurerm and a nonexistent open-constructs/cdk-terrain issue tracker, engineered to look identical to real HashiCorp CDKTF branding.
Credit: OpenSSF (source)
References
Source: amazon-inspector (e647bdd78382c54b0565b5bde30513112aaebc17e80019da2ebfe1cfe3f9a14e)
Package name and branding closely mimic HashiCorp's legitimate cdktf-provider-azurerm (CDK for Terraform), with a single-character substitution (cdktf → cdktn) and fabricated 'CDK Terrain' branding at cdktn.io that mirrors HashiCorp's cdk.tf. PKG-INFO declares
Requires-Dist: cdktn<0.25.0,>=0.24.0, forcing installation of a non-HashiCorp base packagecdktn(analogue of the legitimatecdktf). The top-level module executesimport cdktn._jsiiat load time via src/cdktn_provider_azurerm/_jsii/init.py, so any code shipped in the attacker-controlledcdktnbase runs in the installer's Python process the first time the provider is imported. README and metadata further referencecdktn-io/cdktn-provider-azurermand a nonexistentopen-constructs/cdk-terrainissue tracker, engineered to look identical to real HashiCorp CDKTF branding.Credit: OpenSSF (source)
References