If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
@accenturecodefoundry/mfe-pot-shared-ui-scds-core describes itself as “A simple placeholder for npm.” Its preinstall hook runs `node index.js || true` on npm install. Version 99.99.2 encodes the hostname and username as hexadecimal query parameters and sends them to `accenture-npm.azurewebsites.net/test`; version 99.99.4 sends a GET request to `https://accenture-npm.azurewebsites.net/async`; and version 99.99.41 sends a GET request to `https://accenture-npm.azurewebsites.net/mfe`. The npm account `priyashareek` published it on 2026-10-13.
The package belongs to a dependency confusion campaign by `priyashareek` against the internal scopes @accenturecodefoundry and @newspage. @newspage/libx-amount and @newspage/lib-ng-async-routes-ui from the same publisher call back to the same host. The publisher used 99.99.x versions to outrank the internal packages; 0.0.0-stage and 99.99.1 are empty placeholders. Each beacon reveals the victim's egress IP and tells the operator the dependency confusion worked.
---
_-= Per source details. Do not edit below this line.=-_
Source: amazon-inspector (1a0df5af9df747af01858965f5f2f2671e0e874f84a5054e7b9d8f145d1c488e)
The package uses the @accenturecodefoundry scope with version 99.99.43 and the description 'A simple placeholder for npm.', consistent with a public squat targeting an internal Accenture-scoped package during dependency resolution. package.json declares a preinstall hook that runs index.js. On install, index.js reads HOSTNAME/COMPUTERNAME and USER/USERNAME from the environment, hex-encodes the concatenation, and issues an HTTPS GET to a hardcoded endpoint at accenture-npm.azurewebsites.net with the encoded identifiers in a query parameter. The destination is not a first-party Accenture domain and the behavior is undocumented. The combination of internal-scope impersonation, implausibly high version intended to win resolution against a private package, placeholder content, and an install-time beacon of host identity to an external endpoint is the dependency-confusion reconnaissance pattern.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
Domains
- accenture-npm[.]azurewebsites[.]net other packages →
URLs
- hxxps://accenture-npm[.]azurewebsites[.]net/test other packages →
- hxxps://accenture-npm[.]azurewebsites[.]net/async other packages →
- hxxps://accenture-npm[.]azurewebsites[.]net/mfe other packages →