@drone-js-ext/core@1.0.0

Analysis

@drone-js-ext/core@1.0.0 is a dependency-confusion shim that beacons to a hardcoded IP address on install and on import. Its package.json postinstall hook runs `node beacon.cjs`, and index.js calls the same beacon's fire() when the module is required, so any build that imports the name also triggers it. The beacon sends an HTTP POST to hxxp://185[.]158[.]107[.]175:8787/_ah/dc with an x-beacon-package header; the JSON body carries the package name, the machine hostname, the install directory (__dirname), the current working directory and the npm/node user agent. index.js exports a no-op Proxy so that importing the package does not throw and the install/build completes while the callback is still made. The package ships no repository and its description is "Compatibility shim."