MAL-2026-17642 Malicious code in personio-pipeline-projen (npm)

personio-pipeline-projen presents itself as an authorized dependency-confusion proof-of-concept; the evidence does not identify a copied public package. Its preinstall hook runs on install with node canary.js. The dependency-confusion probe encodes the installing machine's hostname and username, present CI-variable names, and root project and lifecycle identifiers in a DNS label under db2su65ptuma8gfn6ing8e7dx7wp55zit.oast.fun, and sends an HTTPS GET to hrcv3zo9m3z70yr91ssdz669c0ir6ju8.oastify.com. The npm account reaperhackbot256f published it on 2026-10-07 (UTC).

personio-pipeline-projen is an unscoped package on the public npm registry whose name mirrors an internal 'personio-*' dependency, positioning it to be resolved into Personio builds via dependency confusion. The package.json declares a preinstall hook node canary.js. On install, canary.js collects the machine hostname, OS username, the names of CI-related environment variables present on the host, and the installing project's name, and transmits them out-of-band via a DNS lookup to a subdomain of oast.fun (Interactsh collector) and an HTTPS GET to a subdomain of oastify.com (Burp Collaborator). The beacon fires unconditionally and before any installer consent. The README frames the package as authorized research, but the on-install behavior and name-collision shape are identical to a dependency-confusion attack: installer host and user identifiers leave the machine to a third-party collector on every install.