@ecg-internal/media-util-js-lib@2.0.0

Analysis

This package is a dependency-confusion implant published under an internal-looking scoped name. Its package.json postinstall hook runs beacon.cjs, which POSTs a JSON host-fingerprint beacon to the hardcoded IP-literal endpoint hxxp://185[.]158[.]107[.]175:8787/_ah/dc with the header x-beacon-package. The beacon reports the package name, os.hostname(), the install directory (__dirname), process.cwd(), the Node version string and the URL protocol, giving the operator a record of which internal hosts and build paths resolved the name. index.js re-fires the same beacon on every import and exports a Proxy that returns no-op functions for any property access, so a bundler importing the name completes its build instead of crashing — the install succeeds and the callback still fires. The package collects no environment values, credentials, tokens or file contents, and performs no downloads, process spawning or persistence. Its README claims the package is an authorized dependency-confusion test.