MalwarePublished 10 Aug 2026

@noobaihome/amis-uni-area-widget (npm) · Malicious Code

Affects @noobaihome/amis-uni-area-widgetSource GCVE Database

Malicious package : remove @noobaihome/amis-uni-area-widget and rotate any secrets on hosts that installed it.

Data as of 10 Aug 2026, 15:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13690

What to do

Remove @noobaihome/amis-uni-area-widget from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@noobaihome/amis-uni-area-widget	Affected 1.0.0 – 1.0.11 10 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @noobaihome/amis-uni-area-widget contains malicious code in its install script that executes automatically during npm install. This code sends system and environment information to a remote IP address over plain HTTP, downloads and executes an unverified shell script from the same attacker-controlled server, and performs an internal network reconnaissance by fetching data from an internal endpoint and forwarding it to the attacker. These actions enable arbitrary code execution on the installer host and potential internal network information leakage.

Impact

This malicious package enables remote attackers to execute arbitrary code on the host machine during npm install, potentially compromising the system. It also leaks sensitive environment and process information to an external attacker-controlled server and performs internal network reconnaissance via SSRF, which could expose internal network details. The unverified execution of a remote shell script increases the risk of further compromise or persistence.

Defensive guidance

Users should immediately avoid installing or using the affected versions of @noobaihome/amis-uni-area-widget. Audit existing installations for suspicious network activity or unexpected processes. Consider removing the package and replacing it with a trusted alternative. Monitor for updates from the package maintainer or npm security advisories for any official fixes or guidance. Since the malicious code executes automatically on install, manual inspection of package contents before installation is recommended.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Aug 2026, 15:56 UTC

Technical details

References

Community reviews