@cecm-web-sdk/core@1.0.1

Analysis

This package installs an install-time callback. Its package.json postinstall hook runs beacon.cjs, and index.js calls the same beacon on import, sending an HTTP POST to hxxp://185[.]158[.]107[.]175:8787/_ah/dc with the header x-beacon-package. The JSON body carries install metadata only: the package name, the machine hostname, the install directory (__dirname), the working directory, and the Node version string. The rest of the package is a no-op Proxy shim in index.js. The code reads no environment variables, credential files, tokens, or wallet data, and downloads no further payload. The README describes the package as an authorized dependency-confusion test that reports only that it was installed.