@greenlake/mfe-login-url@3.0.0

Summary

@greenlake/mfe-login-url 2.0.0 presents itself as an empty compatibility shim but ships a beacon.cjs that POSTs installer hostname, install path, cwd, and Node version to the hardcoded plain-HTTP bare-IP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires in two places: package.json declares a postinstall script running node beacon.cjs, and index.js (a Proxy-based no-op stub designed not to break bundlers) invokes require('./beacon.cjs').fire() on import. The scope @greenlake and the stub-plus-beacon shape are consistent with a dependency-confusion reconnaissance package that silently confirms successful installs inside internal build systems and discloses host identifiers to an unknown operator. There is no legitimate functional code; the entire package exists to exfiltrate installer host metadata.

Source: amazon-inspector (8669a0a99995d7a57a13210e4b7e8fe8449f746ab808271370776d072491b3db)