MAL-2026-13689

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@noobaihome/amis-simple-area-widget/MAL-2026-13689.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13689
Published
2026-08-10T11:55:51Z
Modified
2026-08-10T12:50:36.964938257Z
Summary
Malicious code in @noobaihome/amis-simple-area-widget (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (642f206459c4677892954c26736b990c72bb01ae9383f917ab664b38d977819f)

@noobaihome/amis-simple-area-widget@1.0.0 advertises an AI Suda amis area-chart widget, but dist/renderer.umd.js and dist/plugin.umd.js are empty stubs (module.exports = {}). The only functional code is scripts/install.js, invoked from a preinstall lifecycle hook, which on npm install fetches http://bsrc-ssrf.n.baidu-int.com/bsrcuid (an internal-only Baidu host reachable only from an installer inside that network perimeter) and POSTs the base64url-encoded response, along with a marker string 'BSRCRCER2557e49c2', to a hardcoded external IP callback at http://49.232.169.67:43817/bsrc-r255. The package name is a dependency-confusion lure against an internal @noobaihome scope. Installing the package causes outbound traffic from the installer's environment to an attacker-chosen public IP carrying content only reachable from inside the target's private network — a blind SSRF / dependency-confusion probe, regardless of any stated bug-bounty framing.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017244",
            "import_time": "2026-08-10T12:24:45.984040839Z",
            "sha256": "642f206459c4677892954c26736b990c72bb01ae9383f917ab664b38d977819f",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-10T11:55:51Z"
        }
    ]
}
References
Credits

Affected packages

npm / @noobaihome/amis-simple-area-widget

Package

Name
@noobaihome/amis-simple-area-widget
View open source insights on deps.dev
Purl
pkg:npm/%40noobaihome/amis-simple-area-widget

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "scripts/install.js",
            "tlsh": "fd310f6a38f725660773f4cc462b8d68f222810320edcfa0ba5d07610f82534d6b12aa",
            "sha256": "86763e2e5283a5664d9a03dbadffc356fbbc86a90c78414dd1c53aaca1140da2"
        }
    ],
    "package_integrity": [
        {
            "filename": "amis-simple-area-widget-1.0.0.tgz",
            "hashes": {
                "sha1": "e8eaaf0049763ecca4e167aad276c9540d113c56",
                "sha512_sri": "sha512-CIOFXNfJn690WAUtOMtrisOiCW/XVd+tSvncgPfxsC9miDcqksSdpY6PEN/oNVGFUWqlnVgpnQYGu2DEoQ4A6w=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@noobaihome/amis-simple-area-widget/MAL-2026-13689.json"