@blueskydataplatform/shared-ui@99.0.3

Summary

The package is a scoped stub whose only runtime effect is a reconnaissance beacon. package.json declares a postinstall script that runs beacon.cjs, which POSTs the installer's hostname (os.hostname()), the install path (__dirname), the current working directory (process.cwd()), the Node version, and the package name over plain HTTP to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc. index.js (the package main) also calls beacon.fire() at top level inside a try/catch, so any require/import of the package fires the same exfiltration even when npm lifecycle scripts are disabled. module.exports is a Proxy returning no-op functions so consuming bundlers do not crash before the beacon completes. The package self-describes as a 'Compatibility shim', ships only index.js and beacon.cjs, and uses version 99.0.3 under an org-looking scope — the structural shape of a dependency-confusion squat intended to overshadow a legitimate internal @blueskydataplatform package and confirm reach into private/CI build environments.

Source: amazon-inspector (6912b4805f58e3b759cf909994ed184b849b226c468f308c562387678be55125)