@grabcad/grabcad-shop-shared@3.0.0

Analysis

This package is a dependency-confusion implant that beacons host metadata to a hardcoded IP on install and again on import. Its package.json declares a postinstall hook running beacon.cjs, which HTTP-POSTs a JSON body to hxxp://185[.]158[.]107[.]175:8787/_ah/dc with an X-Beacon-Package header; index.js re-fires the same beacon whenever the module is required and exports a Proxy that returns no-op functions so importing code does not crash. The beaconed body contains the package name, the machine hostname (os.hostname()), the install path (__dirname), the working directory, the npm/node user-agent string and the protocol. The package is a four-file, ~1.5KB "compatibility shim" that provides no real functionality, and its README asserts the callback is an authorized dependency-confusion test. The shipped files read no environment values, no npm or GitHub tokens, no .npmrc, no cloud credentials, no SSH/AWS files, no file contents and no wallet data, and spawn no processes or persistence; the collected data is host and install-location metadata sent to a single hardcoded endpoint.