Terraform init pulling modules from typosquatted HashiCorp registry

Ibrahim Saud@tektrix

•updated Sep 21, 2026•1•0•5

This rule detects Terraform CLI execution of the 'init' command correlated with network access to HashiCorp AWS registry domains, or the presence of Terraform lock files in specific sensitive or project-related directory paths. This combination often indicates infrastructure-as-code management activities or potential misuse of Terraform in a production environment.