@grabcad/grabcad-shop-shared@1.0.1

Analysis

This package is a dependency-confusion implant that reports every install back to a hardcoded callback address. Its postinstall hook runs `node beacon.cjs`, and index.js fires the same beacon again whenever the module is required, so a build that imports the name also calls back. The beacon is an HTTP POST to hxxp://185[.]158[.]107[.]175:8787/_ah/dc with an `x-beacon-package` header and a JSON body containing the package name, the machine hostname, the install path (__dirname), the working directory, and the npm/node user agent. The module exports a no-op Proxy so importing code does not crash and the callback still completes. The package README describes it as an authorized dependency-confusion test; the code collects and transmits only install metadata, with no credential, token, environment-value or file-content access.