MAL-2026-13689
Dashboard / Malicious Package / MAL-2026-13689
MAL-2026-13689
Summary: Malicious code in @noobaihome/amis-simple-area-widget (npm)
Details: Source: amazon-inspector (642f206459c4677892954c26736b990c72bb01ae9383f917ab664b38d977819f) @noobaihome/[email protected] advertises an AI Suda amis area-chart widget, but dist/renderer.umd.js and dist/plugin.umd.js are empty stubs (module.exports = {}). The only functional code is scripts/install.js, invoked from a preinstall lifecycle hook, which on npm install fetches http://bsrc-ssrf.n.baidu-int.com/bsrc_uid (an internal-only Baidu host reachable only from an installer inside that network perimeter) and POSTs the base64url-encoded response, along with a marker string 'BSRC_RCE_R255_7e49c2', to a hardcoded external IP callback at http://49.232.169.67:43817/bsrc-r255. The package name is a dependency-confusion lure against an internal @noobaihome scope. Installing the package causes outbound traffic from the installer's environment to an attacker-chosen public IP carrying content only reachable from inside the target's private network — a blind SSRF / dependency-confusion probe, regardless of any stated bug-bounty framing.
Affected packages
Package
Name: @noobaihome/amis-simple-area-widget
Purl: pkg:npm/%40noobaihome/amis-simple-area-widget
Affected ranges
Type: N/A
Events:
