Malicious code in personio-pipeline-projen (npm)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

personio-pipeline-projen presents itself as an authorized dependency-confusion proof-of-concept; the evidence does not identify a copied public package. Its preinstall hook runs on install with `node canary.js`. The dependency-confusion probe encodes the installing machine's hostname and username, present CI-variable names, and root project and lifecycle identifiers in a DNS label under `db2su65ptuma8gfn6ing8e7dx7wp55zit.oast.fun`, and sends an HTTPS GET to `hrcv3zo9m3z70yr91ssdz669c0ir6ju8.oastify.com`. The npm account `reaperhackbot256f` published it on 2026-10-07 (UTC). --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9edcf2a339a16ea7096c68d06ec14250f3735eb3eb608f07bb2fe0004f8b9423) personio-pipeline-projen is an unscoped package on the public npm registry whose name mirrors an internal 'personio-*' dependency, positioning it to be resolved into Personio builds via dependency confusion. The package.json declares a preinstall hook `node canary.js`. On install, canary.js collects the machine hostname, OS username, the names of CI-related environment variables present on the host, and the installing project's name, and transmits them out-of-band via a DNS lookup to a subdomain of oast.fun (Interactsh collector) and an HTTPS GET to a subdomain of oastify.com (Burp Collaborator). The beacon fires unconditionally and before any installer consent. The README frames the package as authorized research, but the on-install behavior and name-collision shape are identical to a dependency-confusion attack: installer host and user identifiers leave the machine to a third-party collector on every install.

Source published

7 Oct 2026 04:52:26 UTC

Source modified

8 Oct 2026 04:00:04 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.