@greenlake/session@2.0.0

Analysis

This package is a dependency-confusion implant published under a scoped name, presenting itself as a "Compatibility shim". Its package.json declares a postinstall hook that runs beacon.cjs, and index.js additionally calls the same beacon when the module is imported, so the callback fires both at install time and on first require. beacon.cjs sends an HTTP POST to hxxp://185[.]158[.]107[.]175:8787/_ah/dc carrying a JSON body with the package name, the machine hostname, the install path (__dirname), the current working directory, the npm/node user agent and the protocol, tagged with an x-beacon-package header. index.js exports a Proxy that returns no-op functions for every property access so that a build importing the name completes instead of crashing, keeping the host silent about the substitution. The callback endpoint is a bare IP literal with no TLS.