@drone-js-ext/vip-badge@0.1.0

Analysis

This package is the code-less name-claim version of @drone-js-ext/vip-badge: version 0.1.0 ships only package.json and a one-line README (174 bytes unpacked) with no executable code. The same package name was subsequently published with an install-time telemetry payload: a "postinstall": "node beacon.cjs" hook runs beacon.cjs, which sends an HTTP POST to hxxp://185[.]158[.]107[.]175:8787/_ah/dc carrying the package name, os.hostname(), the install directory (__dirname), process.cwd(), the Node version and the transport protocol, with an x-beacon-package header. The same beacon is shipped by @drone-js-ext/core@2.0.1 and @drone-js-ext/core@3.0.0. The beacon collects host metadata only — no credentials, tokens, environment values or file contents are read or transmitted — but it reports every install to a hardcoded IP address over plaintext HTTP without the installer's knowledge.