@ppa-web-components/ppa-builder@2.0.1

Analysis

This package is a dependency-confusion implant published under a scoped name that collides with an internal package. Its postinstall hook runs beacon.cjs, and importing the package (index.js) triggers the same beacon again, sending an HTTP POST to hxxp://185[.]158[.]107[.]175:8787/_ah/dc with a JSON body containing the package name, the machine hostname, the install directory (__dirname), the working directory, the npm/node user agent and the protocol, plus an X-Beacon-Package header. index.js otherwise exports a no-op Proxy so that imports of the real package name do not crash, letting the install complete and the callback fire. The package collects no credentials, tokens, environment values or file contents, and performs no other network, exec or persistence activity.