MAL-2026-4824

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/pypi/cdktn-provider-datadog/MAL-2026-4824.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4824
Withdrawn
2026-05-26T17:27:32Z
Published
2026-05-26T15:09:17Z
Modified
2026-05-27T00:32:10Z
Summary
Malicious code in cdktn-provider-datadog (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (29ce930466b101c48ae641d7e4ad57f3d5169b9f14b1e041e4264e75cbfd965b)

Package name cdktn-provider-datadog is a single-character variant (f→n) of HashiCorp's widely-used cdktf-provider-datadog CDKTF provider. README and source have been edited to reference a fictitious 'CDK Terrain' project at cdktn.io / github.com/cdktn-io. setup.py declares install_requires=['cdktn>=0.23.0, <0.24.0',...], and src/cdktn_provider_datadog/_jsii/__init__.py unconditionally executes import cdktn._jsii at module load. Installing this package therefore forces resolution and installation of a separately-published cdktn core package in a parallel typosquat namespace controlled by an unrelated third party. A developer who mistypes the legitimate package name pulls in the entire cdktn* namespace as transitive dependencies, whose code runs whenever the provider is imported.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-004925",
            "import_time": "2026-05-26T16:47:31.442160835Z",
            "modified_time": "2026-05-26T15:09:17Z",
            "sha256": "29ce930466b101c48ae641d7e4ad57f3d5169b9f14b1e041e4264e75cbfd965b",
            "source": "amazon-inspector",
            "versions": [
                "15.1.1"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / cdktn-provider-datadog

Package

Name
cdktn-provider-datadog
View open source insights on deps.dev
Purl
pkg:pypi/cdktn-provider-datadog

Affected ranges

Affected versions

15.*
15.1.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "setup.py",
            "sha256": "e971505ed73893dd40132212f994d15c4d6939dbcad7371bce6690babe8d2932",
            "tlsh": "136231d4fc9a685100993800acd57804e0a676871b0725bcbb7f84ecfb66d2bf5f66c9"
        }
    ],
    "package_integrity": [
        {
            "filename": "cdktn_provider_datadog-15.1.1-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "b32b6f68578fbe713fcdb5200e65e8334bae899a59dfbe0df12ab663dc43957e",
                "md5": "c4d9411876a1b0d0c144ae0d222adb2e",
                "sha256": "fffbedf51067ace6b7bb6a4c9e8088eacdb65f86465886730c8188cc053d948a"
            }
        },
        {
            "filename": "cdktn_provider_datadog-15.1.1.tar.gz",
            "hashes": {
                "blake2b_256": "7c3631b7ac55fe0262ff99046c4f49121d1761c3058c82455585754aab941ae1",
                "md5": "0b466bc50f12a61a5d78c9b2149d1ed3",
                "sha256": "60a0c8a29a9916b9c68074bf95b4accca2000d176716f2b8a567773778180443"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/pypi/cdktn-provider-datadog/MAL-2026-4824.json"