@accenturecodefoundry/mfe-pot-shared-ui-scds-core@99.99.43

Summary

The package uses the @accenturecodefoundry scope with version 99.99.43 and the description 'A simple placeholder for npm.', consistent with a public squat targeting an internal Accenture-scoped package during dependency resolution. package.json declares a preinstall hook that runs index.js. On install, index.js reads HOSTNAME/COMPUTERNAME and USER/USERNAME from the environment, hex-encodes the concatenation, and issues an HTTPS GET to a hardcoded endpoint at accenture-npm.azurewebsites.net with the encoded identifiers in a query parameter. The destination is not a first-party Accenture domain and the behavior is undocumented. The combination of internal-scope impersonation, implausibly high version intended to win resolution against a private package, placeholder content, and an install-time beacon of host identity to an external endpoint is the dependency-confusion reconnaissance pattern.

Source: amazon-inspector (1a0df5af9df747af01858965f5f2f2671e0e874f84a5054e7b9d8f145d1c488e)