Malicious code in @noobaihome/amis-uni-area-widget (npm)

The npm package @noobaihome/amis-uni-area-widget was found to contain malicious code in its scripts/install.js file that executed automatically during the npm preinstall phase. The malicious script performed three attacker-controlled actions on the installer's host system.\n\nFirst, the script unconditionally beaconed installer identifiers (process ID, base64-encoded working directory, base64-encoded INIT_CWD environment variable, and a marker) over plain HTTP to a hardcoded bare-IP endpoint at http://49.232.169.67:43817/bsrc-r260. Second, when a parent build manifest matched an internal marker, the script downloaded an unpinned and unverified shell script from http://49.232.169.67:80/slt via curl (with wget fallback) and executed it via /bin/sh using spawnSync, granting the attacker arbitrary code execution on the installer at install time. Third, the script fetched an internal-network endpoint at http://bsrc-ssrf.n.baidu-int.com/bsrc_uid (reachable only from inside a specific corporate network) and forwarded the base64-encoded response back to the same callback IP, characteristic of SSRF-driven internal reconnaissance.\n\nThe destination IP address has no documented relationship to any legitimate package publisher, and all behaviors executed automatically without user interaction. The incident was identified by the OpenSSF malicious-packages project and reported via GitHub Advisory GHSA-932g-6p3v-rp3w.