@ppa-web-components/ppa-builder@1.0.0

Analysis

This package is a dependency-confusion beacon. Its postinstall hook runs beacon.cjs, which sends an HTTP POST to hxxp://185[.]158[.]107[.]175:8787/_ah/dc carrying a JSON body with the package name, the machine hostname, the install path, the working directory and the npm user-agent, plus an x-beacon-package header. index.js re-sends the same beacon whenever the module is required and exports a no-op Proxy so that imports of the real package do not fail. The package collects and transmits only that install metadata; no credentials, environment values, tokens or file contents are read or sent, and no second-stage payload is fetched or executed. The package describes itself as an authorized dependency-confusion test that only reports that it was installed.