MAL-2026-17867

Dashboard / Malicious Package / MAL-2026-17867

MAL-2026-17867

Summary: Malicious code in @accenturecodefoundry/mfe-pot-shared-ui-scds-core (npm)

Details: @accenturecodefoundry/mfe-pot-shared-ui-scds-core describes itself as “A simple placeholder for npm.” Its preinstall hook runs `node index.js || true` on npm install. Version 99.99.2 encodes the hostname and username as hexadecimal query parameters and sends them to `accenture-npm.azurewebsites.net/test`; version 99.99.4 sends a GET request to `https://accenture-npm.azurewebsites.net/async`; and version 99.99.41 sends a GET request to `https://accenture-npm.azurewebsites.net/mfe`. The npm account `priyashareek` published it on 2026-10-13. The package belongs to a dependency confusion campaign by `priyashareek` against the internal scopes @accenturecodefoundry and @newspage. @newspage/libx-amount and @newspage/lib-ng-async-routes-ui from the same publisher call back to the same host. The publisher used 99.99.x versions to outrank the internal packages; 0.0.0-stage and 99.99.1 are empty placeholders. Each beacon reveals the victim's egress IP and tells the operator the dependency confusion worked. Source: amazon-inspector (1a0df5af9df747af01858965f5f2f2671e0e874f84a5054e7b9d8f145d1c488e) The package uses the @accenturecodefoundry scope with version 99.99.43 and the description 'A simple placeholder for npm.', consistent with a public squat targeting an internal Accenture-scoped package during dependency resolution. package.json declares a preinstall hook that runs index.js. On install, index.js reads HOSTNAME/COMPUTERNAME and USER/USERNAME from the environment, hex-encodes the concatenation, and issues an HTTPS GET to a hardcoded endpoint at accenture-npm.azurewebsites.net with the encoded identifiers in a query parameter. The destination is not a first-party Accenture domain and the behavior is undocumented. The combination of internal-scope impersonation, implausibly high version intended to win resolution against a private package, placeholder content, and an install-time beacon of host identity to an external endpoint is the dependency-confusion reconnaissance pattern.

References: https://www.npmjs.com/package/@accenturecodefoundry/mfe-pot-shared-ui-scds-core, https://www.npmjs.com/package/@accenturecodefoundry/mfe-pot-shared-ui-scds-core/v/99.99.43, https://www.npmjs.com/package/@accenturecodefoundry/mfe-pot-shared-ui-scds-core/v/99.99.4, https://www.npmjs.com/package/@accenturecodefoundry/mfe-pot-shared-ui-scds-core/v/99.99.2, https://www.npmjs.com/package/@accenturecodefoundry/mfe-pot-shared-ui-scds-core/v/99.99.41