gha-lab-b9842b12c0

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of projen/projen at commit...

Malicious code in personio-pipeline-projen (npm)

personio-pipeline-projen presents itself as an authorized dependency-confusion proof-of-concept; the evidence does not identify a copied public package. Its preinstall hook runs on install with node canary.js. The dependency-confusion probe encodes the installing machine's hostname and username,...

Malicious code in personio-pipeline-projen (npm)

personio-pipeline-projen presents itself as an authorized dependency-confusion proof-of-concept; the evidence does not identify a copied public package. Its preinstall hook runs on install with node canary.js. The dependency-confusion probe encodes the installing machine's hostname and username,...

MAL-2026-17642 Malicious code in personio-pipeline-projen (npm)

personio-pipeline-projen presents itself as an authorized dependency-confusion proof-of-concept; the evidence does not identify a copied public package. Its preinstall hook runs on install with node canary.js. The dependency-confusion probe encodes the installing machine's hostname and username,...

Malicious Package

Overview personio-pipeline-projen is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

@langri-sha/projen-babel (>=0.5.11, <=0.5.12), @langri-sha/projen-eslint (>=0.3.12, <=0.3.13) +6 more potentially affected by CVE-2026-97711 via serialize-javascript (7.1.1)

serialize-javascript NPM version 7.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on serialize-javascript and may be impacted: - @langri-sha/projen-babel =0.5.11, =0.3.12, =0.4.13, =0.3.13, =0.4.12, =0.29.0, =0.65.78-next.15, =0.4.0, =0.6.1 Source...

@langri-sha/projen-babel (>=0.5.11, <=0.5.12), @langri-sha/projen-eslint (>=0.3.12, <=0.3.13) +6 more potentially affected by CVE-2026-97711 via serialize-javascript (7.1.1)

serialize-javascript NPM version 7.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on serialize-javascript and may be impacted: - @langri-sha/projen-babel =0.5.11, =0.3.12, =0.4.13, =0.3.13, =0.4.12, =0.29.0, =0.65.78-next.15, =0.4.0, =0.6.1 Source...

@langri-sha/projen-babel (>=0.5.11, <=0.5.12), @langri-sha/projen-eslint (>=0.3.12, <=0.3.13) +6 more potentially affected by CVE-2026-97711 via serialize-javascript (7.1.1)

serialize-javascript NPM version 7.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on serialize-javascript and may be impacted: - @langri-sha/projen-babel =0.5.11, =0.3.12, =0.4.13, =0.3.13, =0.4.12, =0.29.0, =0.65.78-next.15, =0.4.0, =0.6.1 Source...

@alma-cdk/construct-library (>=0.0.0, <=0.0.26), @amazon-codecatalyst/blueprint-component.dev-environments (>=0.3.0, <=0.3.159) +145 more potentially affected by CVE-2026-89065 via projen (>=0.3.178, <=0.100.7)

projen NPM version =0.3.178, =0.0.0, =0.3.0, =0.3.0, =0.3.60, =0.3.59, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.1, =0.3.65, =0.3.82, =0.3.1, =0.3.159 - @amazon-codecatalyst/blueprints.serverless-tinyurl 0.3.0 and more Source cves: CVE-2026-89065 Source advisory: SNYK:JS-PROJEN-19823700...

@alma-cdk/construct-library (>=0.0.0, <=2.3.0), @amazon-codecatalyst/blueprint-component.dev-environments (>=0.3.0, <=0.3.159) +146 more potentially affected by CVE-2026-89066 via projen (>=0.3.178, <=0.101.37)

projen NPM version =0.3.178, =0.0.0, =0.3.0, =0.3.0, =0.3.60, =0.3.59, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.1, =0.3.65, =0.3.82, =0.3.1, =0.3.159 - @amazon-codecatalyst/blueprints.serverless-tinyurl 0.3.0 and more Source cves: CVE-2026-89066 Source advisory: SNYK:JS-PROJEN-19823705...

Relative Path Traversal

Overview projen is a CDK for software projects Affected versions of this package are vulnerable to Relative Path Traversal in the manifest cleanup routine that processes .projen/files.json during synthesis, which resolves each manifest entry against the project directory with path.resolve without...

apidays24pj (>=0.0.5, <=0.0.15), aws-pdk (>=0.20.0, <=0.26.15) +33 more potentially affected by CVE-2026-89066 via projen (>=0.16.42, <=0.101.37)

projen PYPI version =0.16.42, =0.0.5, =0.20.0, =0.0.10, =0.12.9, =0.2.5, =0.12.10, =0.12.18, =0.4.0, =0.0.73, =0.0.68, =0.0.92, =0.0.68, =0.0.73, =0.15.3, =0.0.4, =0.0.9 and more Source cves: CVE-2026-89066 Source advisory: SNYK:PYTHON-PROJEN-19823704...

apidays24pj (>=0.0.5, <=0.0.15), aws-pdk (>=0.20.0, <=0.26.15) +33 more potentially affected by CVE-2026-89065 via projen (>=0.16.42, <=0.99.80)

projen PYPI version =0.16.42, =0.0.5, =0.20.0, =0.0.10, =0.12.9, =0.2.5, =0.12.10, =0.12.18, =0.4.0, =0.0.73, =0.0.68, =0.0.92, =0.0.68, =0.0.73, =0.15.3, =0.0.4, =0.0.9 and more Source cves: CVE-2026-89065 Source advisory: SNYK:PYTHON-PROJEN-19823701...

Command Injection

Overview projen is a CDK for software projects Affected versions of this package are vulnerable to Command Injection in the task synthesis, which interpolates configuration properties and auto-discovered file names into the generated .projen/tasks.json without escaping shell metacharacters,...

Relative Path Traversal

Overview projen is a CDK for software projects Affected versions of this package are vulnerable to Relative Path Traversal in the manifest cleanup routine that processes .projen/files.json during synthesis, which resolves each manifest entry against the project directory with path.resolve without...

Command Injection

Overview projen is a CDK for software projects Affected versions of this package are vulnerable to Command Injection in the task synthesis, which interpolates configuration properties and auto-discovered file names into the generated .projen/tasks.json without escaping shell metacharacters,...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal in the manifest cleanup routine that processes .projen/files.json during synthesis, which resolves each manifest entry against the project directory with path.resolve without verifying that the result remains...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection in the task synthesis, which interpolates configuration properties and auto-discovered file names into the generated .projen/tasks.json without escaping shell metacharacters, affecting properties including extraArgs,...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal in the manifest cleanup routine that processes .projen/files.json during synthesis, which resolves each manifest entry against the project directory with path.resolve without verifying that the result remains...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection in the task synthesis, which interpolates configuration properties and auto-discovered file names into the generated .projen/tasks.json without escaping shell metacharacters, affecting properties including extraArgs,...