GCVE-110-OSM-2026-13423

personio-pipeline-projen presents itself as an authorized dependency-confusion proof-of-concept; the evidence does not identify a copied public package. Its preinstall hook runs on install with `node canary.js`. The dependency-confusion probe encodes the installing machine's hostname and username, present CI-variable names, and root project and lifecycle identifiers in a DNS label under `db2su65ptuma8gfn6ing8e7dx7wp55zit.oast.fun`, and sends an HTTPS GET to `hrcv3zo9m3z70yr91ssdz669c0ir6ju8.oastify.com`. The npm account `reaperhackbot256f` published it on 2026-10-07 (UTC). ENTRY canary.js (install-hook: node canary.js) - Install Hook Executes Local JS File in package.json DESTINATION - 3 exfil (oast, custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in canary.js: ".oast.fun" - Data Encoding for Exfiltration in canary.js: "encodeURIComponent(tag), function (r) { r.destroy(); }).on('error', function () ..." - System Information Collection in canary.js: "os.hostname()" - Suspicious Domain in canary.js: "oast.fun" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES canary.js