@grabcad/grabcad-shop-shared@99.0.1

Summary

The package publishes under the @grabcad scope but provides no real functionality: index.js exports a Proxy stub that no-ops every property access, and the package self-describes as a 'Compatibility shim'. A postinstall hook runs node beacon.cjs, and index.js also invokes the same fire() routine on require. beacon.cjs POSTs a JSON payload containing the package name, os.hostname(), __dirname (install path), process.cwd(), and process.version to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plaintext HTTP. The combination of a scope-matching stub plus install-time and require-time reconnaissance to a non-registry, non-publisher bare-IP destination is the canonical dependency-confusion recon pattern: the stub lets a consumer build succeed silently after accidentally resolving this package instead of an internal @grabcad package, while the beacon discloses the victim's hostname, project path, and runtime to the operator for follow-on targeting.

Source: amazon-inspector (8b255034a9e973919c82be7b2f75db934cc8a385c6cb388c6d632769b6ed0889)