@accenturecodefoundry/mfe-pot-shared-ui-scds-core

{"schema_version":"1.7.4","id":"MAL-2026-17867","published":"2026-10-13T13:37:54Z","modified":"2026-10-16T06:59:40.665644059Z","summary":"Malicious code in @accenturecodefoundry/mfe-pot-shared-ui-scds-core (npm)","details":"@accenturecodefoundry/mfe-pot-shared-ui-scds-core describes itself as “A simple placeholder for npm.” Its preinstall hook runs `node index.js || true` on npm install. Version 99.99.2 encodes the hostname and username as hexadecimal query parameters and sends them to `accenture-npm.azurewebsites.net/test`; version 99.99.4 sends a GET request to `https://accenture-npm.azurewebsites.net/async`; and version 99.99.41 sends a GET request to `https://accenture-npm.azurewebsites.net/mfe`. The npm account `priyashareek` published it on 2026-10-13.\n\nThe package belongs to a dependency confusion campaign by `priyashareek` against the internal scopes @accenturecodefoundry and @newspage. @newspage/libx-amount and @newspage/lib-ng-async-routes-ui from the same publisher call back to the same host. The publisher used 99.99.x versions to outrank the internal packages; 0.0.0-stage and 99.99.1 are empty placeholders. Each beacon reveals the victim's egress IP and tells the operator the dependency confusion worked.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1a0df5af9df747af01858965f5f2f2671e0e874f84a5054e7b9d8f145d1c488e)\nThe package uses the @accenturecodefoundry scope with version 99.99.43 and the description 'A simple placeholder for npm.', consistent with a public squat targeting an internal Accenture-scoped package during dependency resolution. package.json declares a preinstall hook that runs index.js. On install, index.js reads HOSTNAME/COMPUTERNAME and USER/USERNAME from the environment, hex-encodes the concatenation, and issues an HTTPS GET to a hardcoded endpoint at accenture-npm.azurewebsites.net with the encoded identifiers in a query parameter. The destination is not a first-party Accenture domain and the behavior is undocumented. The combination of internal-scope impersonation, implausibly high version intended to win resolution against a private package, placeholder content, and an install-time beacon of host identity to an external endpoint is the dependency-confusion reconnaissance pattern.\n","affected":[{"package":{"name":"@accenturecodefoundry/mfe-pot-shared-ui-scds-core","ecosystem":"npm"},"versions":["99.99.2","99.99.4","99.99.41","99.99.43"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"529ea7a92b1caed5b10313c7cdfe1d6d37eec0dc583d2088090cc26e20217d8a","tlsh":"dbe026fdd36d540c02e217c1912dee3ae97bf1d9318460f268582a1b5ff27a006637a6"},{"path":"package.json","sha256":"97bef7bee0026a6779c4bcb6c321e7abd79ba3f5c0566437157d9d05f4c0b633","tlsh":"eee07238ac710e732ad602a80a228a0a71288c0b08087c082bd3015c87db2b380bf28e"}],"package_integrity":[{"filename":"mfe-pot-shared-ui-scds-core-99.99.43.tgz","hashes":{"sha1":"ea540ea46a05f662354421a3d7cb09d61f1d4c1f","sha512_sri":"sha512-Lwy2/CtCKyB0idLFycuQCn7hIWlgJDTDZO47r/Ygcx6cCsrPjQpGq62TcReHmGwo6RvwPk2KQ9IHT/7AKyMcmw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@accenturecodefoundry/mfe-pot-shared-ui-scds-core"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@accenturecodefoundry/mfe-pot-shared-ui-scds-core/v/99.99.43"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@accenturecodefoundry/mfe-pot-shared-ui-scds-core/v/99.99.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@accenturecodefoundry/mfe-pot-shared-ui-scds-core/v/99.99.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@accenturecodefoundry/mfe-pot-shared-ui-scds-core/v/99.99.41"}],"database_specific":{"iocs":{"domains":["accenture-npm.azurewebsites.net"],"files":[{"digests":{"sha256":"ad1e9a69cb24381b516b6e60d56b23d0a9d610de0ca3678f503052ff425e848b"},"note":"preinstall script: node index.js || true","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"d40b29bc2dc00b0e87f30e84b4b288a410d5ebe2a6ab10df76c2cfbd6cf0cf9f"},"note":"Executed by the preinstall script of @accenturecodefoundry/mfe-pot-shared-ui-scds-core@99.99.2.","paths":["index.js"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"d1f08011d600052b00bf7556c97b73a20601c238f4f4508c8266817f4c0cb067"},"note":"preinstall script: node index.js || true","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"b353e473eee3b51f2e4ccbdbf4d4c544f104b9b12cd1170a7cbe730719a3880f"},"note":"Executed by the preinstall script of @accenturecodefoundry/mfe-pot-shared-ui-scds-core@99.99.4.","paths":["index.js"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"c214afaf441c41e3eae402639451b94b0a7f156104218ef4d0cbe7277143b14f"},"note":"preinstall script: node index.js || true","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"9d453ac4168e26b7d60d61821aceaba4ebbb25875d4524d4807a5fc3dd194d24"},"note":"Executed by the preinstall script of @accenturecodefoundry/mfe-pot-shared-ui-scds-core@99.99.41.","paths":["index.js"],"source":"PACKAGE_ARCHIVE"}],"urls":["https://accenture-npm.azurewebsites.net/test","https://accenture-npm.azurewebsites.net/async","https://accenture-npm.azurewebsites.net/mfe"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-021474","import_time":"2026-10-16T06:57:50.249704417Z","modified_time":"2026-10-16T06:53:50Z","sha256":"1a0df5af9df747af01858965f5f2f2671e0e874f84a5054e7b9d8f145d1c488e","source":"amazon-inspector","versions":["99.99.43"]},{"id":"IN-MAL-2026-021471","import_time":"2026-10-16T06:57:50.05589495Z","modified_time":"2026-10-16T06:53:20Z","sha256":"2b3f41aba7ec69e44f8afde51055c8d1dd9387031befceaf147351ad3e2706cd","source":"amazon-inspector","versions":["99.99.4"]},{"id":"IN-MAL-2026-021472","import_time":"2026-10-16T06:57:50.116114001Z","modified_time":"2026-10-16T06:53:27Z","sha256":"9a51b12449f026d462c888b4a384faf9200a4e714307c1c2147bf16ed7f06199","source":"amazon-inspector","versions":["99.99.2"]},{"id":"IN-MAL-2026-021470","import_time":"2026-10-16T06:57:49.971073166Z","modified_time":"2026-10-16T06:53:10Z","sha256":"d5f178f19b8e2fa63fb4eee8d7ee66429c1e1914867584e388f9fd7230027bce","source":"amazon-inspector","versions":["99.99.41"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"},{"name":"SafeDep","contact":["https://safedep.io"],"type":"FINDER"}]}