@blueskydataplatform/shared-ui@0.1.0

Analysis

@blueskydataplatform/shared-ui is a dependency-confusion package that reports installs to a hardcoded remote endpoint. Version 0.1.0 is a 181-byte placeholder containing only package.json and a one-line README, with no executable code; the same package name is published in code-bearing versions (0.0.1, 1.0.0, 1.0.1, 2.0.0, 2.0.1) that carry the payload. In those versions package.json declares "postinstall": "node beacon.cjs". beacon.cjs POSTs a JSON body to hxxp://185[.]158[.]107[.]175:8787/_ah/dc containing the package name, os.hostname(), the install directory (__dirname), process.cwd(), and the Node version, with the header x-beacon-package. index.js fires the same beacon again whenever the module is required and exports a Proxy whose every property is a no-op function, so a build that imports the real package's named or default exports completes instead of crashing. The README describes the package as an "authorized dependency-confusion test" and names a researcher contact, but the callback runs unconditionally on install and on import. The collected data is host and path metadata only: no environment variable values, tokens, credential files or file contents are read or transmitted. IOC: 185[.]158[.]107[.]175:8787, path /_ah/dc.