@grabcad/grabcad-shop-shared@1.0.0

Analysis

This package impersonates an internal-looking scoped library (@grabcad/grabcad-shop-shared) and is described as a "Compatibility shim", but its postinstall hook runs beacon.cjs, which sends an HTTP POST of a JSON body containing the package name, hostname, install path, working directory and npm user agent to hxxp://185[.]158[.]107[.]175:8787/_ah/dc with an X-Beacon-Package header. index.js re-fires the same beacon whenever the module is required, and exports a Proxy that returns no-op functions for every property so that importing code does not crash and the callback still happens. The beacon is hardcoded to a bare IP literal with no TLS, and the package contains no functional library code — its only purpose is to report installs of the name back to that endpoint.