{"id":"MAL-2026-4825","summary":"Malicious code in cdktn-provider-newrelic (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (51996ccf23fd3d3b291f945e2ec88504c93d7e302e183c7633632b8a03d1590d)\nPackage name 'cdktn-provider-newrelic' is a single-character edit (cdktf→cdktn) of HashiCorp's official 'cdktf-provider-newrelic' (CDK for Terraform NewRelic provider bindings). The package replicates the target's full API surface — 80+ Terraform resource modules including alert_policy, nrql_alert_condition, and synthetics_* — and rebrands 'CDK for Terraform (cdktf)' as 'CDK Terrain (cdktn)' across the README and metadata, with a fabricated homepage (cdktn.io) and GitHub org (cdktn-io / open-constructs). setup.py declares install_requires of 'cdktn\u003e=0.23.0,\u003c0.24.0' — itself a typosquat of HashiCorp's 'cdktf' runtime — so a developer who mistypes the package name during `pip install` silently pulls a sibling typosquat package whose code runs at import time. The combination of a top-tier registry typosquat, full API mimicry to evade detection by would-be users, and a transitive typosquat dependency injected via install_requires constitutes namespace-abuse: the install resolves attacker-controlled code into the developer's environment under cover of HashiCorp's published API.\n","modified":"2026-05-27T00:32:10.055633588Z","published":"2026-05-26T15:08:38Z","withdrawn":"2026-05-26T17:27:32Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-05-26T15:08:38Z","sha256":"51996ccf23fd3d3b291f945e2ec88504c93d7e302e183c7633632b8a03d1590d","source":"amazon-inspector","versions":["15.0.5"],"id":"IN-MAL-2026-004924","import_time":"2026-05-26T16:47:31.406727201Z"}]},"references":[{"type":"PACKAGE","url":"https://pypi.org/project/cdktn-provider-newrelic/15.0.5/"}],"affected":[{"package":{"name":"cdktn-provider-newrelic","ecosystem":"PyPI","purl":"pkg:pypi/cdktn-provider-newrelic"},"versions":["15.0.5"],"database_specific":{"indicators":{"package_integrity":[{"filename":"cdktn_provider_newrelic-15.0.5-py3-none-any.whl","hashes":{"blake2b_256":"40d0b6d9bd0520606f5ec59a2c42325b525f06dd890737dd136a4ac27e35fb5d","md5":"f9fde7baef3f5c45e666ea8048dd4988","sha256":"79a9bb8d87392b035cd8fb4337fba9997b5e431be914d73f5b6a5d82c40d69fa"}},{"filename":"cdktn_provider_newrelic-15.0.5.tar.gz","hashes":{"md5":"bd2a33c24a5a2801e6e1b2aecd433018","sha256":"acd0f49d7caa60b877cdb4e4c9b2920316c1d47c5f05e210538af05a7ca55eab","blake2b_256":"91c5ac4f4dcaa64c48dcc2894d97d5b65f3286b6fdea6f2bb7791367b329532b"}}],"evidence_files":[{"path":"setup.py","sha256":"8b9855d507ad37d2cff0c13dcb23de6ad58aedf0c1712986377c3aa4044e36e1","tlsh":"0cd16951fa939eb101ea19807cc92d00ea5612936d001e6cff4e897cfb7b9ea15751cf"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/pypi/cdktn-provider-newrelic/MAL-2026-4825.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}