@grabcad/user-license@3.0.0

Analysis

A combosquat of the @grabcad scope that ships an install-time host-fingerprinting beacon. package.json declares "postinstall": "node beacon.cjs", and index.js additionally calls require('./beacon.cjs').fire() on import, so the beacon fires both at install and whenever the module is loaded. beacon.cjs POSTs JSON to the hardcoded IP-literal endpoint hxxp://185[.]158[.]107[.]175:8787/_ah/dc with an x-beacon-package header, reporting the package name, os.hostname(), the install directory (__dirname), process.cwd(), and the npm/node user-agent. index.js exports a no-op Proxy so that a build importing the name completes instead of crashing, keeping the callback silent. The package is described only as a "Compatibility shim" and contains no functional code beyond the beacon.