{"id":"MAL-2026-17642","revision":"20c8e88d0ba849c4bf543584c8544174","records":[{"revision":"20c8e88d0ba849c4bf543584c8544174","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17642","aliases":[],"title":"Malicious code in personio-pipeline-projen (npm)","description":"personio-pipeline-projen presents itself as an authorized dependency-confusion proof-of-concept; the evidence does not identify a copied public package. Its preinstall hook runs on install with `node canary.js`. The dependency-confusion probe encodes the installing machine's hostname and username, present CI-variable names, and root project and lifecycle identifiers in a DNS label under `db2su65ptuma8gfn6ing8e7dx7wp55zit.oast.fun`, and sends an HTTPS GET to `hrcv3zo9m3z70yr91ssdz669c0ir6ju8.oastify.com`. The npm account `reaperhackbot256f` published it on 2026-10-07 (UTC).\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9edcf2a339a16ea7096c68d06ec14250f3735eb3eb608f07bb2fe0004f8b9423)\npersonio-pipeline-projen is an unscoped package on the public npm registry whose name mirrors an internal 'personio-*' dependency, positioning it to be resolved into Personio builds via dependency confusion. The package.json declares a preinstall hook `node canary.js`. On install, canary.js collects the machine hostname, OS username, the names of CI-related environment variables present on the host, and the installing project's name, and transmits them out-of-band via a DNS lookup to a subdomain of oast.fun (Interactsh collector) and an HTTPS GET to a subdomain of oastify.com (Burp Collaborator). The beacon fires unconditionally and before any installer consent. The README frames the package as authorized research, but the on-install behavior and name-collision shape are identical to a dependency-confusion attack: installer host and user identifiers leave the machine to a third-party collector on every install.\n","state":0,"publishedAt":"2026-10-07T04:52:26+00:00","modifiedAt":"2026-10-08T04:00:04.2490688+00:00","affected":[{"ecosystem":"npm","name":"personio-pipeline-projen","ranges":[],"versions":["1.171.31"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/personio-pipeline-projen","https://www.npmjs.com/package/personio-pipeline-projen/v/1.171.31"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17642","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17642","identifiers":["MAL-2026-17642"]},"retained":false,"historicalAffected":[]}],"coverage":[]}