@greenlake/auth@3.0.0

Summary

The package declares postinstall: node beacon.cjs and additionally fires the same beacon from index.js on require(). The beacon POSTs a JSON payload containing os.hostname(), __dirname (install path), process.cwd(), and the Node version to the hardcoded plain-HTTP bare-IP endpoint http://185.158.107.175:8787/_ah/dc, which is unrelated to any @greenlake publisher infrastructure. The package otherwise ships no functional code: index.js self-describes as a 'Compatibility shim' and exports a Proxy whose get trap returns a no-op for every property access. The shape — a @scope/<name> no-op shim whose only behavior is identifying the installing host to an attacker-controlled IP on npm install — matches the dependency-confusion probe pattern, where a public package is published under an internal scope name to map which corporate installers resolve to the public registry.

Source: amazon-inspector (d51386d7bf7b3357a9ea920b99fa08f3c2d37532e877f33a5d8d0a78c12702b5)