A Terraform provider is a plugin that lets Terraform talk to an external service such as a cloud platform, DNS system, or SaaS API. Providers translate Terraform configuration into API calls, so they are often installed as part of normal infrastructure setup and automation.
This matters because a provider sits in a trusted path. If a malicious or tampered provider is installed, it can execute during provisioning, inspection, or build workflows without needing a classic exploit. In supply-chain attacks, threat actors may hide code inside a provider package and rely on normal developer or CI usage to deliver it. Defenders reduce this risk by pinning provider sources and versions, verifying provenance, reviewing changes before updates, and limiting what automation can download. Because providers often touch cloud credentials and infrastructure controls, even a short-lived compromise can expose secrets or alter environments.