Malicious code in @noobaihome/amis-simple-area-widget (npm)
The npm package @noobaihome/amis-simple-area-widget version 1.0.0 contains malicious code that executes during installation. Instead of providing functional widget code, it uses a preinstall script to fetch data from an internal Baidu network address and then sends this data to an external attacker-controlled IP. This behavior enables a blind server-side request forgery (SSRF) and dependency confusion attack, potentially leaking internal network information to an external party.
AI Analysis
Technical Summary
The package @noobaihome/[email protected] advertises an AI Suda amis area-chart widget but contains empty stub files for its main modules. The only active code is in scripts/install.js, which runs during the npm preinstall lifecycle. This script fetches data from an internal-only Baidu host (http://bsrc-ssrf.n.baidu-int.com/bsrc_uid) that is only reachable from within the target's private network. It then base64url-encodes the response and sends it along with a marker string to a hardcoded external IP (http://49.232.169.67:43817/bsrc-r255). This mechanism acts as a blind SSRF and dependency confusion probe, leaking internal network information to an attacker-controlled endpoint.
Potential Impact
Installing this package causes outbound network traffic from the installer's environment to an attacker-controlled external IP, carrying data retrieved from an internal private network resource. This can lead to information disclosure about internal network infrastructure and potentially facilitate further attacks. The malicious package is a dependency confusion lure targeting internal @noobaihome scoped packages.
Mitigation Recommendations
No official patch or remediation is documented. Users should avoid installing the @noobaihome/amis-simple-area-widget package version 1.0.0 from untrusted sources. Verify package authenticity and source before installation, especially for packages that mimic internal scopes. Monitor and restrict outbound network traffic during package installation to prevent data exfiltration. Check vendor advisories or trusted security sources for updates on remediation.
Malicious code in @noobaihome/amis-simple-area-widget (npm)
Description
The npm package @noobaihome/amis-simple-area-widget version 1.0.0 contains malicious code that executes during installation. Instead of providing functional widget code, it uses a preinstall script to fetch data from an internal Baidu network address and then sends this data to an external attacker-controlled IP. This behavior enables a blind server-side request forgery (SSRF) and dependency confusion attack, potentially leaking internal network information to an external party.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The package @noobaihome/[email protected] advertises an AI Suda amis area-chart widget but contains empty stub files for its main modules. The only active code is in scripts/install.js, which runs during the npm preinstall lifecycle. This script fetches data from an internal-only Baidu host (http://bsrc-ssrf.n.baidu-int.com/bsrc_uid) that is only reachable from within the target's private network. It then base64url-encodes the response and sends it along with a marker string to a hardcoded external IP (http://49.232.169.67:43817/bsrc-r255). This mechanism acts as a blind SSRF and dependency confusion probe, leaking internal network information to an attacker-controlled endpoint.
Potential Impact
Installing this package causes outbound network traffic from the installer's environment to an attacker-controlled external IP, carrying data retrieved from an internal private network resource. This can lead to information disclosure about internal network infrastructure and potentially facilitate further attacks. The malicious package is a dependency confusion lure targeting internal @noobaihome scoped packages.
Mitigation Recommendations
No official patch or remediation is documented. Users should avoid installing the @noobaihome/amis-simple-area-widget package version 1.0.0 from untrusted sources. Verify package authenticity and source before installation, especially for packages that mimic internal scopes. Monitor and restrict outbound network traffic during package installation to prevent data exfiltration. Check vendor advisories or trusted security sources for updates on remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13689
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a79f0dbbf8831d539f618a9
Added to database: 08/10/2026, 15:40:11 UTC
Last enriched: 08/10/2026, 15:57:54 UTC
Last updated: 08/10/2026, 15:57:54 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.