@greenlake/common-context@3.0.0

Analysis

@greenlake/common-context@3.0.0 is a dependency-confusion implant aimed at the private @greenlake scope. Its package.json declares "postinstall": "node beacon.cjs", so the payload runs automatically on install. beacon.cjs POSTs a JSON body to the hardcoded endpoint hxxp://185[.]158[.]107[.]175:8787/_ah/dc with an X-Beacon-Package header; the body reports the package name, os.hostname(), the install directory (__dirname), process.cwd(), the Node/npm version string and the URL protocol, which lets the operator confirm which internal build machine resolved the squatted name. index.js re-fires the same beacon when the module is imported and exports a no-op Proxy so that a build importing the name completes instead of crashing. The package ships a README claiming it is an authorized dependency-confusion test; the same beacon.cjs and index.js are shipped under the sibling names @greenlake/auth, @greenlake/session, @greenlake/mfe-login-url and @greenlake/context-pane, all reporting to the same 185[.]158[.]107[.]175:8787 endpoint. No credential or file-content exfiltration is present in this version's code.