{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "setup.py",
              "sha256": "e971505ed73893dd40132212f994d15c4d6939dbcad7371bce6690babe8d2932",
              "tlsh": "136231d4fc9a685100993800acd57804e0a676871b0725bcbb7f84ecfb66d2bf5f66c9"
            }
          ],
          "package_integrity": [
            {
              "filename": "cdktn_provider_datadog-15.1.1-py3-none-any.whl",
              "hashes": {
                "blake2b_256": "b32b6f68578fbe713fcdb5200e65e8334bae899a59dfbe0df12ab663dc43957e",
                "md5": "c4d9411876a1b0d0c144ae0d222adb2e",
                "sha256": "fffbedf51067ace6b7bb6a4c9e8088eacdb65f86465886730c8188cc053d948a"
              }
            },
            {
              "filename": "cdktn_provider_datadog-15.1.1.tar.gz",
              "hashes": {
                "blake2b_256": "7c3631b7ac55fe0262ff99046c4f49121d1761c3058c82455585754aab941ae1",
                "md5": "0b466bc50f12a61a5d78c9b2149d1ed3",
                "sha256": "60a0c8a29a9916b9c68074bf95b4accca2000d176716f2b8a567773778180443"
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "cdktn-provider-datadog"
      },
      "versions": [
        "15.1.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "actran@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-004925",
        "import_time": "2026-05-26T16:47:31.442160835Z",
        "modified_time": "2026-05-26T15:09:17Z",
        "sha256": "29ce930466b101c48ae641d7e4ad57f3d5169b9f14b1e041e4264e75cbfd965b",
        "source": "amazon-inspector",
        "versions": [
          "15.1.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (29ce930466b101c48ae641d7e4ad57f3d5169b9f14b1e041e4264e75cbfd965b)\nPackage name `cdktn-provider-datadog` is a single-character variant (f\u2192n) of HashiCorp\u0027s widely-used `cdktf-provider-datadog` CDKTF provider. README and source have been edited to reference a fictitious \u0027CDK Terrain\u0027 project at `cdktn.io` / `github.com/cdktn-io`. setup.py declares `install_requires=[\u0027cdktn\u003e=0.23.0, \u003c0.24.0\u0027,...]`, and `src/cdktn_provider_datadog/_jsii/__init__.py` unconditionally executes `import cdktn._jsii` at module load. Installing this package therefore forces resolution and installation of a separately-published `cdktn` core package in a parallel typosquat namespace controlled by an unrelated third party. A developer who mistypes the legitimate package name pulls in the entire `cdktn*` namespace as transitive dependencies, whose code runs whenever the provider is imported.\n",
  "id": "MAL-2026-4824",
  "modified": "2026-05-26T17:27:32Z",
  "published": "2026-05-26T15:09:17Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/cdktn-provider-datadog/15.1.1/"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in cdktn-provider-datadog (PyPI)",
  "withdrawn": "2026-05-26T17:27:32Z"
}