MAL-2026-4825

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/pypi/cdktn-provider-newrelic/MAL-2026-4825.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4825
Withdrawn
2026-05-26T17:27:32Z
Published
2026-05-26T15:08:38Z
Modified
2026-05-27T00:32:10Z
Summary
Malicious code in cdktn-provider-newrelic (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (51996ccf23fd3d3b291f945e2ec88504c93d7e302e183c7633632b8a03d1590d)

Package name 'cdktn-provider-newrelic' is a single-character edit (cdktf→cdktn) of HashiCorp's official 'cdktf-provider-newrelic' (CDK for Terraform NewRelic provider bindings). The package replicates the target's full API surface — 80+ Terraform resource modules including alert_policy, nrql_alert_condition, and synthetics_* — and rebrands 'CDK for Terraform (cdktf)' as 'CDK Terrain (cdktn)' across the README and metadata, with a fabricated homepage (cdktn.io) and GitHub org (cdktn-io / open-constructs). setup.py declares install_requires of 'cdktn>=0.23.0,<0.24.0' — itself a typosquat of HashiCorp's 'cdktf' runtime — so a developer who mistypes the package name during pip install silently pulls a sibling typosquat package whose code runs at import time. The combination of a top-tier registry typosquat, full API mimicry to evade detection by would-be users, and a transitive typosquat dependency injected via install_requires constitutes namespace-abuse: the install resolves attacker-controlled code into the developer's environment under cover of HashiCorp's published API.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-004924",
            "import_time": "2026-05-26T16:47:31.406727201Z",
            "modified_time": "2026-05-26T15:08:38Z",
            "sha256": "51996ccf23fd3d3b291f945e2ec88504c93d7e302e183c7633632b8a03d1590d",
            "source": "amazon-inspector",
            "versions": [
                "15.0.5"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / cdktn-provider-newrelic

Package

Name
cdktn-provider-newrelic
View open source insights on deps.dev
Purl
pkg:pypi/cdktn-provider-newrelic

Affected ranges

Affected versions

15.*
15.0.5

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "setup.py",
            "sha256": "8b9855d507ad37d2cff0c13dcb23de6ad58aedf0c1712986377c3aa4044e36e1",
            "tlsh": "0cd16951fa939eb101ea19807cc92d00ea5612936d001e6cff4e897cfb7b9ea15751cf"
        }
    ],
    "package_integrity": [
        {
            "filename": "cdktn_provider_newrelic-15.0.5-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "40d0b6d9bd0520606f5ec59a2c42325b525f06dd890737dd136a4ac27e35fb5d",
                "md5": "f9fde7baef3f5c45e666ea8048dd4988",
                "sha256": "79a9bb8d87392b035cd8fb4337fba9997b5e431be914d73f5b6a5d82c40d69fa"
            }
        },
        {
            "filename": "cdktn_provider_newrelic-15.0.5.tar.gz",
            "hashes": {
                "blake2b_256": "91c5ac4f4dcaa64c48dcc2894d97d5b65f3286b6fdea6f2bb7791367b329532b",
                "md5": "bd2a33c24a5a2801e6e1b2aecd433018",
                "sha256": "acd0f49d7caa60b877cdb4e4c9b2920316c1d47c5f05e210538af05a7ca55eab"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/pypi/cdktn-provider-newrelic/MAL-2026-4825.json"