The npm package @noobaihome/amis-uni-area-widget contains malicious code in its install script that executes automatically during npm install. This code sends system and environment information to a remote IP address over plain HTTP, downloads and executes an unverified shell script from the same attacker-controlled server, and performs an internal network reconnaissance by fetching data from an internal endpoint and forwarding it to the attacker. These actions enable arbitrary code execution on the installer host and potential internal network information leakage.