{"id":"MAL-2026-17867","summary":"Malicious code in @accenturecodefoundry/mfe-pot-shared-ui-scds-core (npm)","details":"@accenturecodefoundry/mfe-pot-shared-ui-scds-core describes itself as “A simple placeholder for npm.” Its preinstall hook runs `node index.js || true` on npm install. Version 99.99.2 encodes the hostname and username as hexadecimal query parameters and sends them to `accenture-npm.azurewebsites.net/test`; version 99.99.4 sends a GET request to `https://accenture-npm.azurewebsites.net/async`; and version 99.99.41 sends a GET request to `https://accenture-npm.azurewebsites.net/mfe`. The npm account `priyashareek` published it on 2026-10-13.\n\nThe package belongs to a dependency confusion campaign by `priyashareek` against the internal scopes @accenturecodefoundry and @newspage. @newspage/libx-amount and @newspage/lib-ng-async-routes-ui from the same publisher call back to the same host. The publisher used 99.99.x versions to outrank the internal packages; 0.0.0-stage and 99.99.1 are empty placeholders. Each beacon reveals the victim's egress IP and tells the operator the dependency confusion worked.","modified":"2026-10-14T06:15:05.156097361Z","published":"2026-10-13T13:37:54Z","database_specific":{"iocs":{"urls":["https://accenture-npm.azurewebsites.net/test","https://accenture-npm.azurewebsites.net/async","https://accenture-npm.azurewebsites.net/mfe"],"domains":["accenture-npm.azurewebsites.net"],"files":[{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"ad1e9a69cb24381b516b6e60d56b23d0a9d610de0ca3678f503052ff425e848b"},"note":"preinstall script: node index.js || true","paths":["package.json"]},{"note":"Executed by the preinstall script of @accenturecodefoundry/mfe-pot-shared-ui-scds-core@99.99.2.","paths":["index.js"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"d40b29bc2dc00b0e87f30e84b4b288a410d5ebe2a6ab10df76c2cfbd6cf0cf9f"}},{"paths":["package.json"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"d1f08011d600052b00bf7556c97b73a20601c238f4f4508c8266817f4c0cb067"},"note":"preinstall script: node index.js || true"},{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"b353e473eee3b51f2e4ccbdbf4d4c544f104b9b12cd1170a7cbe730719a3880f"},"note":"Executed by the preinstall script of @accenturecodefoundry/mfe-pot-shared-ui-scds-core@99.99.4.","paths":["index.js"]},{"paths":["package.json"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"c214afaf441c41e3eae402639451b94b0a7f156104218ef4d0cbe7277143b14f"},"note":"preinstall script: node index.js || true"},{"digests":{"sha256":"9d453ac4168e26b7d60d61821aceaba4ebbb25875d4524d4807a5fc3dd194d24"},"note":"Executed by the preinstall script of @accenturecodefoundry/mfe-pot-shared-ui-scds-core@99.99.41.","paths":["index.js"],"source":"PACKAGE_ARCHIVE"}]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@accenturecodefoundry/mfe-pot-shared-ui-scds-core"}],"affected":[{"package":{"name":"@accenturecodefoundry/mfe-pot-shared-ui-scds-core","ecosystem":"npm","purl":"pkg:npm/%40accenturecodefoundry/mfe-pot-shared-ui-scds-core"},"versions":["99.99.2","99.99.4","99.99.41"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@accenturecodefoundry/mfe-pot-shared-ui-scds-core/MAL-2026-17867.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.9.0","credits":[{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"},{"name":"SafeDep","contact":["https://safedep.io"],"type":"FINDER"}]}