@ppa-web-components/ppa-builder@1.0.1

Analysis

This package is a "compatibility shim" whose postinstall hook runs beacon.cjs, which sends an HTTP POST of install metadata — package name, os.hostname(), the __dirname install path, process.cwd() and the npm/node user agent — as JSON to hxxp://185[.]158[.]107[.]175:8787/_ah/dc, tagged with an `x-beacon-package` header. The package's index.js re-fires the same beacon whenever the module is imported, and exports a no-op Proxy so that importing code does not crash. The callback destination is a hardcoded IP literal rather than a named service, and the package otherwise contains no functionality matching its stated purpose.