@ppa-web-components/ppa-banner@3.0.0

Analysis

This package installs a callback beacon. Its package.json declares `"postinstall": "node beacon.cjs"`, and index.js additionally invokes the same beacon whenever the module is required, so the callback fires both at install time and on import. beacon.cjs POSTs a JSON body to hxxp://185[.]158[.]107[.]175:8787/_ah/dc with the header X-Beacon-Package: @ppa-web-components/ppa-banner. The body contains the package name, os.hostname(), __dirname (the install path), process.cwd(), the npm/node user agent string and the protocol. The request is fire-and-forget: errors and a 5-second timeout are swallowed so the install never fails or surfaces the callback. index.js exports a defensive Proxy that returns no-op functions for any property access, so a bundler importing the real package name completes its build instead of crashing. The package is a four-file, ~2.9 KB shim whose only function is to report the host and install location of every machine that installs it to a hardcoded IP address over plain HTTP.