@grabcad/grabcad-shop-shared@0.0.0-stage

Analysis

This package is part of a dependency-confusion campaign that claims internal-looking scoped names (@grabcad/*, @blueskydataplatform/*) using sentinel versions such as 99.0.1. Version 0.0.0-stage is a code-free placeholder — package.json and README.md only, 350 bytes, no scripts, no dependencies — that reserves the package name; its README describes it as a "Temporary Holding Version" placeholder awaiting a staged release. The same package name at 99.0.1 and 2.0.1 ships a postinstall hook "node beacon.cjs" that POSTs host metadata — the package name, os.hostname(), the install directory, process.cwd() and the Node version — to hxxp://185[.]158[.]107[.]175:8787/_ah/dc with an X-Beacon-Package header. index.js re-fires the same beacon when the module is required and exports a Proxy that returns no-op functions for any property access, so a build importing the real package completes instead of crashing; its comments describe the callback as a "build-provenance beacon" and note that "a build that completes and calls back is cleaner evidence". The identical beacon.cjs is shipped under @grabcad/user-license, @grabcad/preferences-client, @grabcad/company-server-shared and @blueskydataplatform/shared-ui.