MAL-2026-17867
Malicious code in @accenturecodefoundry/mfe-pot-shared-ui-scds-core (npm)
Published Oct 13, 2026 · updated Oct 14, 2026
@accenturecodefoundry/mfe-pot-shared-ui-scds-core describes itself as “A simple placeholder for npm.” Its preinstall hook runs on npm install. Version 99.99.2 encodes the hostname and username as hexadecimal query parameters and sends them to ; version 99.99.4 sends a GET request to ; and version 99.99.41 sends a GET request to . The npm account published it on 2026-10-13.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · Catalog
Detected
@accenturecodefoundry/mfe-pot-shared-ui-scds-core describes itself as “A simple placeholder for npm.” Its preinstall hook runs on npm install. Version 99.99.2 encodes the hostname and username as hexadecimal query parameters and sends them to ; version 99.99.4 sends a GET request to ; and version 99.99.41 sends a GET request to . The npm account published it on 2026-10-13.
Oct 14, 2026 · Catalog
Updated
@accenturecodefoundry/mfe-pot-shared-ui-scds-core describes itself as “A simple placeholder for npm.” Its preinstall hook runs on npm install. Version 99.99.2 encodes the hostname and username as hexadecimal query parameters and sends them to ; version 99.99.4 sends a GET request to ; and version 99.99.41 sends a GET request to . The npm account published it on 2026-10-13.
Affected
- npm @accenturecodefoundry/mfe-pot-shared-ui-scds-core99.99.2, 99.99.4, 99.99.41