xblaxw@1.0.0

Analysis

xblaxw@1.0.0 ships a postinstall hook (`node beacon.cjs`) that executes on install and sends a JSON beacon over HTTP to a hardcoded IP address, 185[.]158[.]107[.]175:8787, at path /_ah/dc. The beacon body reports the package name, the machine hostname, the install directory, the current working directory, and the npm/node user agent, and is sent with an `x-beacon-package: xblaxw` header. The package contains no functional code beyond this beacon (index.js is a stub, description "Compatibility shim.", no repository), and its README asserts it is an "authorized dependency-confusion test" while the callback target is a bare IP on a non-standard port rather than any research service. The install-time callback to an external address fingerprints and reports every host that installs the package, the reconnaissance stage of a dependency-confusion implant.