# MAL-2026-17642: Malicious code in personio-pipeline-projen (npm)


- **Type:** Malicious package
- **Package:** `personio-pipeline-projen` (npm)
- **Published:** 7 Oct 2026

## What is MAL-2026-17642?

MAL-2026-17642 is a malicious package in personio-pipeline-projen, published on 7 Oct 2026. 

### Official description

personio-pipeline-projen presents itself as an authorized dependency-confusion proof-of-concept; the evidence does not identify a copied public package. Its preinstall hook runs on install with `node canary.js`. The dependency-confusion probe encodes the installing machine's hostname and username, present CI-variable names, and root project and lifecycle identifiers in a DNS label under `db2su65ptuma8gfn6ing8e7dx7wp55zit.oast.fun`, and sends an HTTPS GET to `hrcv3zo9m3z70yr91ssdz669c0ir6ju8.oastify.com`. The npm account `reaperhackbot256f` published it on 2026-10-07 (UTC).

personio-pipeline-projen is an unscoped package on the public npm registry whose name mirrors an internal 'personio-*' dependency, positioning it to be resolved into Personio builds via dependency confusion. The package.json declares a preinstall hook `node canary.js`. On install, canary.js collects the machine hostname, OS username, the names of CI-related environment variables present on the host, and the installing project's name, and transmits them out-of-band via a DNS lookup to a subdomain of oast.fun (Interactsh collector) and an HTTPS GET to a subdomain of oastify.com (Burp Collaborator). The beacon fires unconditionally and before any installer consent. The README frames the package as authorized research, but the on-install behavior and name-collision shape are identical to a dependency-confusion attack: installer host and user identifiers leave the machine to a third-party collector on every install.

## What should I do about MAL-2026-17642?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-17642 is a malicious package: personio-pipeline-projen (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-17642/ (Markdown: https://insights.sbomify.com/MAL-2026-17642/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-17642

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-17642/
Summaries are generated and may contain mistakes; the official description above is the record.