Malicious code in cdktn-provider-azurerm (PyPI)

A malicious package named cdktn-provider-azurerm was discovered on PyPI, designed to deceive users into installing it instead of HashiCorp's legitimate cdktf-provider-azurerm (CDK for Terraform). The attack uses a single-character substitution (cdktf → cdktn) combined with fabricated branding ("CDK Terrain" at cdktn.io) that closely mirrors HashiCorp's official cdk.tf domain and branding.\n\nThe malicious package declares a dependency on a non-HashiCorp base package named cdktn (analogous to the legitimate cdktf). When the provider module is imported, it automatically executes import cdktn._jsii via src/cdktn_provider_azurerm/_jsii/__init__.py, causing any code shipped in the attacker-controlled cdktn base package to run in the installer's Python process.\n\nThe package metadata and README further reinforce the deception by referencing cdktn-io/cdktn-provider-azurerm and a nonexistent open-constructs/cdk-terrain issue tracker, engineered to appear identical to legitimate HashiCorp CDKTF branding and infrastructure.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages repository.