Malicious code in @ppa-web-components/ppa-headerfooter (npm)

__

Source: amazon-inspector (32234bc8ba0c918d154d680b15a1bcb7ae6f6b7d20365c02095842b84e245dce)

The package ships a beacon.cjs script wired as both the postinstall lifecycle hook (node beacon.cjs) and a require-time side effect from index.js. On install and on require(), the beacon POSTs installer identifiers — os.hostname(), the install path (__dirname), process.cwd(), process.version, and the package name — to the hardcoded bare-IP plaintext HTTP endpoint http://185.158.107.175:8787/_ah/dc. The package otherwise provides no functionality: index.js exports a Proxy that returns a no-op function for every property access, so the beacon is the sole purpose of the package. The combination of a scoped name resembling a web-components namespace, a 'Compatibility shim' description, a functionless Proxy stub, and a bare-IP recon beacon is the shape of a dependency-confusion / typosquat probe measuring where the package resolves inside private build environments, typically preceding a targeted follow-up payload.