@drone-js-ext/core@3.0.0

Analysis

This package is a combosquat of a plausible internal scoped name (@drone-js-ext/core), published at version 3.0.0 as a "compatibility shim" whose only function is an install-time callback. Its package.json declares the postinstall hook "node beacon.cjs", and importing the package also triggers the same callback from index.js. beacon.cjs sends an HTTP POST to hxxp://185[.]158[.]107[.]175:8787/_ah/dc with the header X-Beacon-Package: @drone-js-ext/core and a JSON body containing the package name, the machine hostname, the install directory, the current working directory, the Node version and the URL scheme. The package README describes it as an authorized dependency-confusion test that reports only package, hostname and path. The payload reads no environment variables, tokens, credentials, wallet data or file contents, and performs no other network, process-execution or persistence activity. The tarball is four files totalling under 2 KB.