@cecm-web-sdk/core@0.1.0

Analysis

This package is a dependency-confusion artifact published under a scoped name. Version 99.0.1 declares a postinstall hook, `node beacon.cjs`, and ships beacon.cjs, which sends an HTTP POST of a JSON body to hxxp://185[.]158[.]107[.]175:8787/_ah/dc containing the package name, os.hostname(), the install directory (__dirname), process.cwd() and the Node.js version, tagged with an `x-beacon-package` header. index.js invokes the same beacon when the module is required and exports a Proxy that returns a no-op function for every property access, so a build that imports the name completes instead of failing. Version 0.1.0 is an inert placeholder containing only package.json and a one-line README, with no code, no lifecycle hook and no dependencies. The package's README describes it as an authorized dependency-confusion test. The shipped code collects host and install-path metadata only; no environment values, tokens, credential files or file contents are read or transmitted.