@cecm-web-sdk/core@99.0.1

Summary

The package ships a postinstall hook (scripts.postinstall: "node beacon.cjs") and a main entry (index.js: require('./beacon.cjs').fire()) that both invoke beacon.cjs. beacon.cjs POSTs a payload containing the package name, os.hostname(), __dirname (install path), process.cwd(), and process.version to the hardcoded cleartext endpoint http://185.158.107.175:8787/_ah/dc. The main module is otherwise a Proxy-based no-op stub with no library functionality; the package's only observable effect is the beacon callback. The destination is a bare IPv4 address over plain HTTP, with no TLS, no pinning, and no caller-configurable override. The behavior fires automatically on npm install via the lifecycle hook and again on every require() of the package, delivering installer-side host identifiers to a non-first-party endpoint without consent. The package name uses a scope resembling a vendor SDK while shipping no SDK code.

Source: amazon-inspector (ea27147731ca2c42e40154d06c455a4750a91588b2f8be16e1b237452e20df22)