MalwarePublished 7 Aug 2026

cdktn-provider-azurerm (PyPI) · Malicious Code

Affects cdktn-provider-azurermSource GCVE Database

Malicious package : remove cdktn-provider-azurerm and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 15:24 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-13606

What to do

Remove cdktn-provider-azurerm from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIcdktn-provider-azurerm	Affected =17.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The cdktn-provider-azurerm package on PyPI is a malicious package impersonating the legitimate HashiCorp cdktf-provider-azurerm by using a single-character substitution in its name and mimicking branding. It forces installation of a malicious base package 'cdktn' that executes attacker-controlled code during import, potentially compromising the installer's Python environment. This package version 17.0.0 is affected. There is no CVSS score or known exploits in the wild reported.

Impact

Installation and import of this malicious package results in execution of attacker-controlled code within the Python environment of the user, potentially leading to compromise of the system or environment where the package is installed. This can lead to arbitrary code execution and further malicious activity. No known exploits in the wild have been reported yet.

Defensive guidance

Users should avoid installing the cdktn-provider-azurerm package and verify package names carefully to avoid typosquatting attacks. Use only official sources and verify package authenticity before installation. Since this is a malicious package impersonation, remediation involves uninstalling the package if installed and scanning environments for unauthorized code execution.

Summary

The cdktn-provider-azurerm PyPI package is a typosquatting malicious package designed to impersonate HashiCorp's legitimate cdktf-provider-azurerm by substituting a single character in the name (cdktf → cdktn) and mimicking branding and metadata. The malicious package declares a dependency on a similarly named base package 'cdktn' which is attacker-controlled. When the provider is imported, the malicious base package code executes in the installer's Python process, enabling arbitrary code execution. The package metadata and documentation are engineered to appear authentic, including fabricated issue trackers and branding. The affected version is exactly 17.0.0.

References

pypi.org/project/cdktn-provider-azurerm/17.0.0/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 15:24 UTC

Technical details

References

Community reviews