@drone-js-ext/vip-badge@2.0.0

Analysis

This package is a republish of a name previously found to carry malicious code. Version 2.0.0 ships a postinstall hook, "node beacon.cjs", that sends an HTTP POST to the IP-literal endpoint hxxp://185[.]158[.]107[.]175:8787/_ah/dc with an x-beacon-package header, transmitting the package name, the machine hostname, the install directory (__dirname), the working directory, the npm/node user agent and the protocol. The same beacon is fired again whenever the package's index.js is required, so the callback also occurs at application runtime and not only at install. index.js otherwise exports a Proxy that returns no-op functions for every property access, so importing code does not crash and the callback still completes. The package is a 4-file, ~2.8KB "compatibility shim" whose only real function is the outbound callback to that hardcoded IP address.