@blueskydataplatform/shared-ui@2.0.1

Analysis

This package is a dependency-confusion beacon: installing it runs a postinstall hook ("node beacon.cjs") that POSTs a JSON body to hxxp://185[.]158[.]107[.]175:8787/_ah/dc with the header x-beacon-package: @blueskydataplatform/shared-ui. The beacon body carries host metadata only — the package name, os.hostname(), the install directory (__dirname), process.cwd(), the Node/npm version string and the URL protocol. index.js fires the same beacon when the module is imported and exports a Proxy returning no-op functions for any property access, so a build that imports the squatted name completes without error. No credentials, tokens, environment values, wallet data or file contents are read or transmitted, and there is no second-stage download or code execution. The package README describes it as an authorized dependency-confusion test that reports only that it was installed.