{"id":"MAL-2026-17867","revision":null,"records":[{"revision":"bee09b395f734dcbb32051a89d86d51b","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17867","aliases":[],"title":"Malicious code in @accenturecodefoundry/mfe-pot-shared-ui-scds-core (npm)","description":"@accenturecodefoundry/mfe-pot-shared-ui-scds-core describes itself as “A simple placeholder for npm.” Its preinstall hook runs `node index.js || true` on npm install. Version 99.99.2 encodes the hostname and username as hexadecimal query parameters and sends them to `accenture-npm.azurewebsites.net/test`; version 99.99.4 sends a GET request to `https://accenture-npm.azurewebsites.net/async`; and version 99.99.41 sends a GET request to `https://accenture-npm.azurewebsites.net/mfe`. The npm account `priyashareek` published it on 2026-10-13.\n\nThe package belongs to a dependency confusion campaign by `priyashareek` against the internal scopes @accenturecodefoundry and @newspage. @newspage/libx-amount and @newspage/lib-ng-async-routes-ui from the same publisher call back to the same host. The publisher used 99.99.x versions to outrank the internal packages; 0.0.0-stage and 99.99.1 are empty placeholders. Each beacon reveals the victim's egress IP and tells the operator the dependency confusion worked.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1a0df5af9df747af01858965f5f2f2671e0e874f84a5054e7b9d8f145d1c488e)\nThe package uses the @accenturecodefoundry scope with version 99.99.43 and the description 'A simple placeholder for npm.', consistent with a public squat targeting an internal Accenture-scoped package during dependency resolution. package.json declares a preinstall hook that runs index.js. On install, index.js reads HOSTNAME/COMPUTERNAME and USER/USERNAME from the environment, hex-encodes the concatenation, and issues an HTTPS GET to a hardcoded endpoint at accenture-npm.azurewebsites.net with the encoded identifiers in a query parameter. The destination is not a first-party Accenture domain and the behavior is undocumented. The combination of internal-scope impersonation, implausibly high version intended to win resolution against a private package, placeholder content, and an install-time beacon of host identity to an external endpoint is the dependency-confusion reconnaissance pattern.\n","state":0,"publishedAt":"2026-10-13T13:37:54+00:00","modifiedAt":"2026-10-16T07:15:07.8405798+00:00","affected":[{"ecosystem":"npm","name":"@accenturecodefoundry/mfe-pot-shared-ui-scds-core","ranges":[],"versions":["99.99.2","99.99.4","99.99.41","99.99.43"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/@accenturecodefoundry/mfe-pot-shared-ui-scds-core","https://www.npmjs.com/package/@accenturecodefoundry/mfe-pot-shared-ui-scds-core/v/99.99.43","https://www.npmjs.com/package/@accenturecodefoundry/mfe-pot-shared-ui-scds-core/v/99.99.4","https://www.npmjs.com/package/@accenturecodefoundry/mfe-pot-shared-ui-scds-core/v/99.99.2","https://www.npmjs.com/package/@accenturecodefoundry/mfe-pot-shared-ui-scds-core/v/99.99.41"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17867","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17867","identifiers":["MAL-2026-17867"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T11:02:29.3269367+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-09T11:02:29.3269367+00:00","lastSuccessAt":"2026-11-09T11:02:35.5033455+00:00","error":null,"lastVerifiedAt":"2026-11-09T11:02:35.5033494+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-8a359c2c34b32e9d5ae6bfb0dfbe77525737d387cb73ffa1dc9d8560ac4a618d","complete":true,"records":421363,"lastAttemptAt":"2026-11-09T11:02:25.6637161+00:00","lastSuccessAt":"2026-11-09T11:02:25.604523+00:00","error":null,"lastVerifiedAt":"2026-11-09T11:02:25.6637161+00:00","snapshotPublishedAt":"2026-11-09T10:27:35+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-776f160a8a4245ff82395b78f580cf00","complete":true,"records":13655,"lastAttemptAt":"2026-11-09T11:14:40.9797117+00:00","lastSuccessAt":"2026-11-09T11:14:40.976+00:00","error":null,"lastVerifiedAt":"2026-11-09T11:14:40.976+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13707,"expectedIdentifiers":13707,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T11:02:29.3269367+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T11:02:29.3269367+00:00","lastSuccessAt":"2026-11-09T11:02:35.5044085+00:00","error":null,"lastVerifiedAt":"2026-11-09T11:02:35.5044088+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-4dc74a26d06148ffa8eb6751d602315d","complete":true,"records":13667,"lastAttemptAt":"2026-11-09T11:02:37.2248176+00:00","lastSuccessAt":"2026-11-09T10:04:35.272+00:00","error":null,"lastVerifiedAt":"2026-11-09T10:04:35.272+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13707,"expectedIdentifiers":13707,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-09T11:02:28.1148102+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-09T11:02:28.1148102+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T11:02:27.3222548+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-09T11:02:27.3222548+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-747b24005f13ffe3f133ae77dfb12ae3145f2c7aed5cfebb91eb943ceb4daeb6","complete":true,"records":3060,"lastAttemptAt":"2026-11-09T11:02:28.9741191+00:00","lastSuccessAt":"2026-11-09T10:04:33.8957851+00:00","error":null,"lastVerifiedAt":"2026-11-09T11:02:28.9741191+00:00","snapshotPublishedAt":"2026-11-09T10:03:05+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-e6e6ac3eaece246ff08884368fe1dc99d4d393571e77c126c8f4d38d66697688","complete":true,"records":231297,"lastAttemptAt":"2026-11-09T11:02:27.67422+00:00","lastSuccessAt":"2026-11-09T10:04:27.0059369+00:00","error":null,"lastVerifiedAt":"2026-11-09T11:02:27.67422+00:00","snapshotPublishedAt":"2026-11-09T09:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}