MAL-2026-17867
Malicious code in @accenturecodefoundry/mfe-pot-shared-ui-scds-core (npm)
Published Oct 13, 2026 · updated Oct 14, 2026
@accenturecodefoundry/mfe-pot-shared-ui-scds-core describes itself as “A simple placeholder for npm.” Its preinstall hook runs on npm install. Version 99.99.2 encodes the hostname and username as hexadecimal query parameters and sends them to ; version 99.99.4 sends a GET request to ; and version 99.99.41 sends a GET request to . The npm account published it on 2026-10-13. The package belongs to a dependency confusion campaign by against the internal scopes @accenturecodefoundry and @newspage. @newspage/libx-amount and @newspage/lib-ng-async-routes-ui from the same publisher call back to the same host. The publisher used 99.99.x versions to outrank the internal packages; 0.0.0-stage and 99.99.1 are empty placeholders. Each beacon reveals the victim's egress IP and tells the operator the dependency confusion worked.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · Catalog
Detected
@accenturecodefoundry/mfe-pot-shared-ui-scds-core describes itself as “A simple placeholder for npm.” Its preinstall hook runs on npm install. Version 99.99.2 encodes the hostname and username as hexadecimal query parameters and sends them to ; version 99.99.4 sends a GET request to ; and version 99.99.41 sends a GET request to . The npm account published it on 2026-10-13.
Oct 14, 2026 · Catalog
Updated
@accenturecodefoundry/mfe-pot-shared-ui-scds-core describes itself as “A simple placeholder for npm.” Its preinstall hook runs on npm install. Version 99.99.2 encodes the hostname and username as hexadecimal query parameters and sends them to ; version 99.99.4 sends a GET request to ; and version 99.99.41 sends a GET request to . The npm account published it on 2026-10-13.
Oct 14, 2026 · OSV.dev
Updated
@accenturecodefoundry/mfe-pot-shared-ui-scds-core describes itself as “A simple placeholder for npm.” Its preinstall hook runs on npm install. Version 99.99.2 encodes the hostname and username as hexadecimal query parameters and sends them to ; version 99.99.4 sends a GET request to ; and version 99.99.41 sends a GET request to . The npm account published it on 2026-10-13. The package belongs to a
Affected
- npm @accenturecodefoundry/mfe-pot-shared-ui-scds-core99.99.2, 99.99.4, 99.99.41