@blueskydataplatform/shared-ui@1.0.1

Analysis

This package impersonates the private scoped name @blueskydataplatform/shared-ui and beacons at install time. Its package.json declares a postinstall hook, "node beacon.cjs", which sends an HTTP POST to hxxp://185[.]158[.]107[.]175:8787/_ah/dc with an x-beacon-package header and a JSON body containing the package name, the machine hostname, the install directory (__dirname), the current working directory and the Node/npm version string. The package's index.js fires the same beacon whenever the module is required and exports a no-op Proxy so that imports of the impersonated package name do not fail. The README describes the package as an authorized dependency-confusion test that only reports that it was installed. No environment variables, credential files, tokens, wallet data or file contents are read or transmitted, and there is no remote code execution or second-stage download.