@greenlake/session@3.0.0

Analysis

@greenlake/session@3.0.0 is a 4-file, ~1.5 KB "compatibility shim" that beacons the installing machine to a hardcoded IP-literal endpoint. Its package.json declares `"postinstall": "node beacon.cjs"`, and beacon.cjs POSTs JSON to hxxp://185[.]158[.]107[.]175:8787/_ah/dc with an `x-beacon-package` header. The body contains the package name, the machine hostname (os.hostname()), the install directory (__dirname), the current working directory, the npm/node user agent and the protocol. index.js fires the same beacon again whenever the module is required, so a build that merely resolves the name also reports back. The package ships no functional API: index.js exports a Proxy that returns a no-op function for every property access, so imports of the real package do not crash while the beacon runs. No environment variables, credentials, tokens, SSH/AWS/npm configuration files or file contents are read or transmitted, and no second-stage payload is downloaded or executed. The README describes the package as an authorized dependency-confusion test that only reports that it was installed.