Vulnerability MAL-2026-17867

@accenturecodefoundry/mfe-pot-shared-ui-scds-core describes itself as “A simple placeholder for npm.” Its preinstall hook runs node index.js || true on npm install. Version 99.99.2 encodes the hostname and username as hexadecimal query parameters and sends them to accenture-npm.azurewebsites.net/test; version 99.99.4 sends a GET request to https://accenture-npm.azurewebsites.net/async; and version 99.99.41 sends a GET request to https://accenture-npm.azurewebsites.net/mfe. The npm account priyashareek published it on 2026-10-13.