@ppa-web-components/ppa-builder@0.0.1

Analysis

This package is a combosquat-style dependency-confusion implant: it declares itself a "Compatibility shim" but its package.json postinstall hook runs beacon.cjs, which POSTs install metadata to a hardcoded IP-literal endpoint, hxxp://185[.]158[.]107[.]175:8787/_ah/dc, with an `x-beacon-package` header. The JSON body contains the package name, os.hostname(), __dirname (install path), process.cwd(), the npm/node user agent and the protocol — an install-time host and location fingerprint. index.js fires the same beacon again when the module is imported and exports a no-op Proxy so that importing code does not crash, keeping the install silent. No environment variable values, credentials, tokens, wallet data or file contents are read or transmitted, and no other network destination is contacted.