@grabcad/grabcad-shop-shared@1.1.0

Analysis

This package is a dependency-confusion style implant that beacons host metadata to a hardcoded IP address at install time. Its package.json declares a postinstall hook running `node beacon.cjs`; that script sends an HTTP POST to hxxp://185[.]158[.]107[.]175:8787/_ah/dc with an `x-beacon-package` header set to the package name. The JSON body contains the package name, the machine hostname, the install path (__dirname), the current working directory, and the Node/npm version string. The package's index.js fires the same beacon again whenever the module is required, and exports a no-op Proxy so that imports of the real package's members do not crash the build. The callback destination is a bare IP literal over plain HTTP with no domain. The shipped code reads no credentials, tokens, environment values or file contents, and contains no second-stage download, process execution or persistence.