xblaxw@99.0.1

Analysis

xblaxw@99.0.1 is a shim package that implements no real functionality and beacons on install. It declares a postinstall hook "node beacon.cjs", and its main entry (index.js) also fires the same beacon when the package is imported. beacon.cjs sends an HTTP POST of host metadata — the package name, os.hostname(), the install directory (__dirname), the current working directory, and the Node version — to hxxp://185[.]158[.]107[.]175:8787/_ah/dc, tagged with an "x-beacon-package" header. index.js additionally exports a Proxy that returns no-op functions for any property access, so a build that imports the impersonated package name completes instead of crashing and the install-time callback succeeds. No credentials, environment variables, tokens, or files are read or exfiltrated; the payload is a host-metadata beacon used to confirm the package was installed and to leak the victim's install path and working directory. The high version number (99.0.1) on a name the package does not implement is consistent with a dependency-confusion attack. IOCs: hxxp://185[.]158[.]107[.]175:8787/_ah/dc (185[.]158[.]107[.]175:8787).