@ecg-internal/favourites-ui@99.0.1

Summary

The package publishes under the internal-looking scope @ecg-internal/ and ships a postinstall script (beacon.cjs) plus a top-level require() side effect in index.js that call a fire() function. fire() POSTs a JSON payload containing os.hostname(), the install __dirname, process.cwd(), and the Node version to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. index.js otherwise exports a Proxy whose property access returns a no-op function, and an in-source comment states that 'a build that completes and calls back is cleaner evidence' — the module provides no real functionality and exists only to produce an install-time callback. The combination of an internal-scope name, a stub module, and an automatic bare-IP beacon carrying installer host identifiers is a dependency-confusion probe: build pipelines that mistakenly resolve this public package instead of the intended private @ecg-internal/favourites-ui disclose internal hostnames and build-path information to the operator of 185.158.107.175.

Source: amazon-inspector (e0f37fd70766d2ddda31ffe3b985eba596fd927fdd589a9ceff04d4a695e3bb1)