@ecg-internal/adobe-dmp-js@99.0.1

Summary

Package uses the @ecg-internal/* scope (resembling an internal namespace) and ships a minimal stub whose only effect is to beacon host identifiers to a hardcoded bare-IP endpoint. package.json declares a postinstall that runs beacon.cjs, which POSTs JSON containing os.hostname(), __dirname (install path), process.cwd(), Node version, and the package name to http://185.158.107.175:8787/_ah/dc over plain HTTP. The package main (index.js) also calls require('./beacon.cjs').fire() at top level, so the same callback fires on every require/import. index.js exports a Proxy no-op so property accesses on the module silently return functions, allowing consumer build pipelines to continue without errors and masking that the package is a stub. The hardcoded bare-IP destination over plain HTTP, unrelated to any legitimate Adobe or ECG infrastructure, together with the internal-looking scope and inert functional surface, is the canonical dependency-confusion reconnaissance payload used to map which victims resolved an attacker-published public package in place of a private internal one.

Source: amazon-inspector (8a24a1672f5d2075c0159dee85aaad5dcb27d0cdc7eb6e007bfdbb742b82149f)