@noobaihome/amis-simple-area-widget (npm) · Malicious Code
Affects @noobaihome/amis-simple-area-widgetSource GCVE Database
Malicious package : remove @noobaihome/amis-simple-area-widget and rotate any secrets on hosts that installed it.
Data as of 10 Aug 2026, 15:57 UTC
Malicious package
Published to npm · OSV MAL-2026-13689
What to do
Remove @noobaihome/amis-simple-area-widget from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@noobaihome/amis-simple-area-widget | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package @noobaihome/amis-simple-area-widget version 1.0.0 contains malicious code that executes during installation. Instead of providing functional widget code, it uses a preinstall script to fetch data from an internal Baidu network address and then sends this data to an external attacker-controlled IP. This behavior enables a blind server-side request forgery (SSRF) and dependency confusion attack, potentially leaking internal network information to an external party.