@grabcad/user-license@2.0.1

Analysis

This package is a "compatibility shim" whose postinstall hook runs beacon.cjs, which sends an HTTP POST to hxxp://185[.]158[.]107[.]175:8787/_ah/dc with a JSON body containing the package name, the machine hostname, the install directory (__dirname), the working directory and the npm/node user agent, plus an x-beacon-package header. index.js repeats the same callback whenever the module is required and exports a no-op Proxy so that importing code does not crash. The callback is the only behaviour in the package: no environment variables, credentials, tokens or file contents are read or transmitted, and no second-stage payload is downloaded or executed. The README describes the package as an authorized dependency-confusion test that only reports that it was installed.