Supply-chain threat intelligence
Risk score
92
Indexed incident for cdktn-provider-datadog (pypi).
-= Per source details. Do not edit below this line.=-
Package name cdktn-provider-datadog is a single-character variant (f→n) of HashiCorp's widely-used cdktf-provider-datadog CDKTF provider. README and source have been edited to reference a fictitious 'CDK Terrain' project at cdktn.io / github.com/cdktn-io. setup.py declares install_requires=['cdktn>=0.23.0, <0.24.0',...], and src/cdktn_provider_datadog/_jsii/__init__.py unconditionally executes import cdktn._jsii at module load. Installing this package therefore forces resolution and installation of a separately-published cdktn core package in a parallel typosquat namespace controlled by an unrelated third party. A developer who mistypes the legitimate package name pulls in the entire cdktn* namespace as transitive dependencies, whose code runs whenever the provider is imported.
Affected versions
Indicators
Timeline