@blueskydataplatform/shared-ui@1.0.0

Analysis

This package is a dependency-confusion beacon that impersonates an internal-looking scoped package name (@blueskydataplatform/shared-ui) and is described only as a "Compatibility shim." Its postinstall hook runs beacon.cjs, which POSTs JSON to hxxp://185[.]158[.]107[.]175:8787/_ah/dc with an x-beacon-package header. The reported fields are the package name, os.hostname(), the install directory (__dirname), process.cwd(), the Node version and the protocol. index.js fires the same beacon when the module is required and exports a Proxy that returns a no-op function for any property access, so a build that imports the name completes instead of failing. No environment values, tokens, credential files or file contents are read or transmitted by the code. The README describes the package as an authorized dependency-confusion test.