NodeBB ActivityPub attributedTo UID Spoof - Outbound Actor Fetch (Exploitarium)

Ethan Andrews@eandrews

•updated Jul 1, 2026•0•0•0

Detects Node.js processes associated with NodeBB making outbound network connections to suspicious paths (/users/, /activities/, /inbox, /.well-known/webfinger). This activity may indicate exploitation of the NodeBB ActivityPub plugin (attributedTo UID spoofing), where an attacker forces the application to fetch attacker-controlled URIs.