{"id":"MAL-2026-4824","summary":"Malicious code in cdktn-provider-datadog (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (29ce930466b101c48ae641d7e4ad57f3d5169b9f14b1e041e4264e75cbfd965b)\nPackage name `cdktn-provider-datadog` is a single-character variant (f→n) of HashiCorp's widely-used `cdktf-provider-datadog` CDKTF provider. README and source have been edited to reference a fictitious 'CDK Terrain' project at `cdktn.io` / `github.com/cdktn-io`. setup.py declares `install_requires=['cdktn\u003e=0.23.0, \u003c0.24.0',...]`, and `src/cdktn_provider_datadog/_jsii/__init__.py` unconditionally executes `import cdktn._jsii` at module load. Installing this package therefore forces resolution and installation of a separately-published `cdktn` core package in a parallel typosquat namespace controlled by an unrelated third party. A developer who mistypes the legitimate package name pulls in the entire `cdktn*` namespace as transitive dependencies, whose code runs whenever the provider is imported.\n","modified":"2026-05-27T00:32:10.038527750Z","published":"2026-05-26T15:09:17Z","withdrawn":"2026-05-26T17:27:32Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-05-26T15:09:17Z","sha256":"29ce930466b101c48ae641d7e4ad57f3d5169b9f14b1e041e4264e75cbfd965b","source":"amazon-inspector","versions":["15.1.1"],"id":"IN-MAL-2026-004925","import_time":"2026-05-26T16:47:31.442160835Z"}]},"references":[{"type":"PACKAGE","url":"https://pypi.org/project/cdktn-provider-datadog/15.1.1/"}],"affected":[{"package":{"name":"cdktn-provider-datadog","ecosystem":"PyPI","purl":"pkg:pypi/cdktn-provider-datadog"},"versions":["15.1.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/pypi/cdktn-provider-datadog/MAL-2026-4824.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"tlsh":"136231d4fc9a685100993800acd57804e0a676871b0725bcbb7f84ecfb66d2bf5f66c9","path":"setup.py","sha256":"e971505ed73893dd40132212f994d15c4d6939dbcad7371bce6690babe8d2932"}],"package_integrity":[{"filename":"cdktn_provider_datadog-15.1.1-py3-none-any.whl","hashes":{"blake2b_256":"b32b6f68578fbe713fcdb5200e65e8334bae899a59dfbe0df12ab663dc43957e","md5":"c4d9411876a1b0d0c144ae0d222adb2e","sha256":"fffbedf51067ace6b7bb6a4c9e8088eacdb65f86465886730c8188cc053d948a"}},{"filename":"cdktn_provider_datadog-15.1.1.tar.gz","hashes":{"sha256":"60a0c8a29a9916b9c68074bf95b4accca2000d176716f2b8a567773778180443","blake2b_256":"7c3631b7ac55fe0262ff99046c4f49121d1761c3058c82455585754aab941ae1","md5":"0b466bc50f12a61a5d78c9b2149d1ed3"}}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}