@blueskydataplatform/shared-ui@99.0.3

Analysis

This package impersonates an internal-looking scoped dependency (@blueskydataplatform/shared-ui) at version 99.0.3 while describing itself only as a "Compatibility shim" — the dependency-confusion shape. Its package.json declares "postinstall": "node beacon.cjs", and beacon.cjs POSTs a JSON body to hxxp://185[.]158[.]107[.]175:8787/_ah/dc with an x-beacon-package header. The reported fields are the package name, os.hostname(), the install directory (__dirname), process.cwd(), the Node version and the transport protocol, giving the operator a host and location fingerprint of every machine that installs it. index.js additionally calls require('./beacon.cjs').fire() at import time, so the beacon also fires whenever the module is loaded, not only at install. index.js and dist/index.js export catch-all Proxy stubs that return undefined for any property access, and the remaining dist/* modules are no-op stubs, so the package provides no real functionality. No environment variables, credentials, tokens or file contents are read or transmitted by this version.