@drone-js-ext/vip-badge@0.0.1

Analysis

This package runs a postinstall hook (`node beacon.cjs`) that sends an HTTP POST of install metadata to a hardcoded IP-literal endpoint, hxxp://185[.]158[.]107[.]175:8787/_ah/dc, with an `x-beacon-package` header. The transmitted JSON contains the package name, the machine hostname, the install directory, the current working directory and the npm user-agent string. Requiring the package's index.js triggers the same beacon again; index.js otherwise exports a no-op Proxy so that importing the name does not fail. The package's own README describes it as an authorized dependency-confusion test that only reports that it was installed. No credentials, tokens, environment values, wallet data or file contents are read or transmitted by the code in this version.