@cecm-web-sdk/core@99.0.1

Analysis

This package is a dependency-confusion stub: it declares version 99.0.1 on the scoped name @cecm-web-sdk/core and ships a near-empty tarball (four files, ~1.5 KB) whose only real code is an install-time beacon. package.json runs `node beacon.cjs` as a postinstall hook, and index.js calls the same beacon when the module is required, so the callback fires on install and again on import. The beacon sends an HTTP POST to hxxp://185[.]158[.]107[.]175:8787/_ah/dc with a JSON body containing the package name, the machine hostname, the install directory (__dirname), the current working directory and the Node version, plus an `x-beacon-package` header. index.js then exports a catch-all Proxy that returns a no-op function for every property access, so a build that imports the real package name completes instead of crashing. No environment variables, tokens, credential files or file contents are read or transmitted; the payload is limited to install metadata reporting to the hardcoded IP endpoint.