@noobaihome/amis-simple-area-widget @1.0.0

Summary

@noobaihome/amis-simple-area-widget@1.0.0 advertises an AI Suda amis area-chart widget, but dist/renderer.umd.js and dist/plugin.umd.js are empty stubs (module.exports = {}). The only functional code is scripts/install.js, invoked from a preinstall lifecycle hook, which on npm install fetches http://bsrc-ssrf.n.baidu-int.com/bsrc_uid (an internal-only Baidu host reachable only from an installer inside that network perimeter) and POSTs the base64url-encoded response, along with a marker string 'BSRC_RCE_R255_7e49c2', to a hardcoded external IP callback at http://49.232.169.67:43817/bsrc-r255. The package name is a dependency-confusion lure against an internal @noobaihome scope. Installing the package causes outbound traffic from the installer's environment to an attacker-chosen public IP carrying content only reachable from inside the target's private network — a blind SSRF / dependency-confusion probe, regardless of any stated bug-bounty framing.

Source: amazon-inspector (642f206459c4677892954c26736b990c72bb01ae9383f917ab664b38d977819f)