@grabcad/preferences-client@3.0.0

Summary

The package presents itself as a 'Compatibility shim' under the @grabcad scope and exports a Proxy that returns no-op functions for any property access, allowing builds that import the real @grabcad/preferences-client to succeed. The main entry invokes require('./beacon.cjs').fire() at import time, and package.json wires the same beacon into a postinstall lifecycle script. beacon.cjs POSTs a payload containing the package name, os.hostname(), the install path, process.cwd(), and the Node version to the hardcoded plain-HTTP endpoint http://185.158.107.175:8787/_ah/dc. The destination is a bare IPv4 on a non-standard port with no relationship to any legitimate publisher infrastructure; the @grabcad scope belongs to a known vendor and the public registry entry is a stub whose only functional effect is the beacon. This is the canonical dependency-confusion reconnaissance pattern: a public squat under an internal/private scope that fires on install and on require to disclose internal hostnames and build paths to an attacker-controlled collector, establishing feasibility for a follow-on payload against installers whose resolver pulls the public package instead of the internal one.

Source: amazon-inspector (c846a3e9766d663572fb4d716588823020e219af5c1fb75793661c5c87627ba5)