The npm package @noobaihome/amis-simple-area-widget version 1.0.0 contains malicious code that executes during installation. Instead of providing functional widget code, it uses a preinstall script to fetch data from an internal Baidu network address and then sends this data to an external attacker-controlled IP. This behavior enables a blind server-side request forgery (SSRF) and dependency confusion attack, potentially leaking internal network information to an external party.