@ppa-web-components/ppa-navigation@99.0.1

Summary

The package is a shim whose only functional payload is a beacon. package.json declares a postinstall that runs node beacon.cjs, and index.js additionally invokes require('./beacon.cjs').fire() on load, so the beacon fires both at npm install and whenever any consumer requires the package. The beacon POSTs the installer's hostname, install path, current working directory, and Node version to the hardcoded bare-IP plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The destination is not a registry, not a documented first-party service, and the plain-IP + non-standard port shape is inconsistent with any legitimate vendor telemetry. The package otherwise exports a Proxy that returns no-op functions for every property and self-describes as a 'Compatibility shim', so the beacon is the entire payload. The scoped name @ppa-web-components/ppa-navigation has the shape of a dependency-confusion or typosquat probe against an internal @ppa-web-components namespace.

Source: amazon-inspector (c88c344e72bb7cf5ae6f5e6185a1024caf8b96bce96584d448609ab78cd894af)