The cdktn-provider-azurerm PyPI package is a typosquatting malicious package designed to impersonate HashiCorp's legitimate cdktf-provider-azurerm by substituting a single character in the name (cdktf → cdktn) and mimicking branding and metadata. The malicious package declares a dependency on a similarly named base package 'cdktn' which is attacker-controlled. When the provider is imported, the malicious base package code executes in the installer's Python process, enabling arbitrary code execution. The package metadata and documentation are engineered to appear authentic, including fabricated issue trackers and branding. The affected version is exactly 17.0.0. There is no vendor patch or fix information available.

Installation and import of this malicious package results in execution of attacker-controlled code within the Python environment of the user, potentially leading to compromise of the system or environment where the package is installed. This can lead to arbitrary code execution and further malicious activity. No known exploits in the wild have been reported yet.

Users should avoid installing the cdktn-provider-azurerm package and verify package names carefully to avoid typosquatting attacks. Use only official sources and verify package authenticity before installation. Since this is a malicious package impersonation, remediation involves uninstalling the package if installed and scanning environments for unauthorized code execution. There is no official patch or fix; the threat is mitigated by avoiding the malicious package.