@greenlake/session@99.0.1

Summary

The package is a scoped-namespace shim (version 99.0.1) whose main entry re-exports a Proxy returning no-op functions, allowing consumer builds to resolve this name without errors. On npm install (postinstall hook) and on require('@greenlake/session') (main-module side effect), beacon.cjs issues a plain-HTTP POST to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc carrying a JSON payload containing os.hostname(), __dirname (install path), process.cwd(), and process.version. The inflated version number, scoped name mimicking an internal namespace, Proxy no-op surface, and automatic beacon on both install and import together form a dependency-confusion exfiltration shape: any build that resolves @greenlake/session from the public registry instead of the intended private source leaks internal host identifiers and install locations to the hardcoded endpoint.

Source: amazon-inspector (3255cc4148a62c7ba090d1912d41c572f3ce7ccb6db9cc131132cfd4a0970f43)