Malicious code in @ppa-web-components/ppa-builder (npm)

__

Source: amazon-inspector (132a763229562f58056a9865006e3645b39657374a953534c63474e8ad54f8be)

The package is a shim with no functional code: its main module exports a Proxy that returns a no-op function for every property, so any import of the scoped name succeeds silently. A postinstall script (beacon.cjs) and the main module both POST host-identifying data — package name, os.hostname(), __dirname install path, process.cwd(), and process.version — to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. The beacon fires automatically on npm install via the postinstall lifecycle hook and again on require() of the main entry, with no opt-in and no documentation. The destination is not a first-party or vendor-affiliated host, and the scoped name resembles a legitimate component library, consistent with a dependency-confusion / typosquat reconnaissance beacon.