The malicious install.js script in the @noobaihome/amis-uni-area-widget npm package performs three attacker-beneficial actions during npm preinstall: (1) it sends installer identifiers including process ID and base64-encoded current working directories to a hardcoded external IP address over unencrypted HTTP, (2) it conditionally downloads and executes an unpinned shell script from the same attacker-controlled server, allowing arbitrary code execution on the host at install time, and (3) it fetches data from an internal corporate network endpoint and forwards the base64-encoded response to the attacker, indicating SSRF-based internal reconnaissance. These behaviors occur automatically on installation without verification or user consent.

This malicious package enables remote attackers to execute arbitrary code on the host machine during npm install, potentially compromising the system. It also leaks sensitive environment and process information to an external attacker-controlled server and performs internal network reconnaissance via SSRF, which could expose internal network details. The unverified execution of a remote shell script increases the risk of further compromise or persistence.

No official patch or remediation is currently documented. Users should immediately avoid installing or using the affected versions of @noobaihome/amis-uni-area-widget. Audit existing installations for suspicious network activity or unexpected processes. Consider removing the package and replacing it with a trusted alternative. Monitor for updates from the package maintainer or npm security advisories for any official fixes or guidance. Since the malicious code executes automatically on install, manual inspection of package contents before installation is recommended.