personio-pipeline-projen

Details

**Severity:** Critical

**Affected versions:** `= 1.171.31`

personio-pipeline-projen presents itself as an authorized dependency-confusion proof-of-concept; the evidence does not identify a copied public package. Its preinstall hook runs on install with `node canary.js`. The dependency-confusion probe encodes the installing machine's hostname and username, present CI-variable names, and root project and lifecycle identifiers in a DNS label under `db2su65ptuma8gfn6ing8e7dx7wp55zit.oast.fun`, and sends an HTTPS GET to `hrcv3zo9m3z70yr91ssdz669c0ir6ju8.oastify.com`. The npm account `reaperhackbot256f` published it on 2026-10-07 (UTC).

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/8615f2c135e171be4ef56228ea0cb1c7eb80fc2a/osv/malicious/npm/personio-pipeline-projen/MAL-2026-17642.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/8615f2c135e171be4ef56228ea0cb1c7eb80fc2a/osv/malicious/npm/personio-pipeline-projen/MAL-2026-17642.json
- https://www.npmjs.com/package/personio-pipeline-projen
- https://github.com/ossf/malicious-packages/blob/1f0efa038b4952b6f39151f24f216b7f464d67c4/osv/malicious/npm/personio-pipeline-projen/MAL-2026-17642.json
- https://www.npmjs.com/package/personio-pipeline-projen/v/1.171.31
- https://github.com/advisories/GHSA-ph63-hxpv-5cwm

Compromised versions (1)

• = 1.171.31

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.