@grabcad/grabcad-shop-shared@2.0.0

Analysis

This package is a dependency-confusion implant that beacons to a hardcoded callback host at install time. Its package.json declares a postinstall hook running "node beacon.cjs", which sends an HTTP POST to hxxp://185[.]158[.]107[.]175:8787/_ah/dc carrying the header x-beacon-package: @grabcad/grabcad-shop-shared. The JSON body reports the package name, the machine hostname (via os.hostname()), the install path (__dirname), the working directory, the npm/node version string, and the protocol. index.js re-fires the same beacon whenever the module is required, and exports a Proxy that returns a no-op function for every property access so that a project importing this name does not crash — the package is built to survive being consumed as a dependency-confusion target and to report back that it was installed. The README describes the package as part of an authorized dependency-confusion test that reports only that it was installed. The collected data is limited to host and install metadata: no environment variable values, credential files, wallet data or file contents are read or transmitted, and no second-stage payload is downloaded or executed.