@drone-js-ext/core@2.0.1

Analysis

This package is a dependency-confusion implant: it uses a scoped name that mimics an internal package and runs a beacon at install time. Its postinstall hook executes beacon.cjs, which sends an HTTP POST to hxxp://185[.]158[.]107[.]175:8787/_ah/dc with an x-beacon-package header carrying the package name. The request body reports the machine hostname, the install directory, the working directory, the npm/node user agent and the protocol. index.js re-fires the same beacon whenever the package is imported and otherwise exports a no-op Proxy shim so that importing code does not fail. The same beacon code and endpoint appear in @drone-js-ext/core@3.0.0, @drone-js-ext/vip-badge@1.0.1 and 2.0.0, and @ppa-web-components/ppa-builder@1.0.1, 2.0.1 and 3.0.0.