@ecg-internal/favourites-ui 2.0.0

Details

Installing @ecg-internal/favourites-ui 2.0.0 runs the postinstall script node beacon.cjs. It sends an HTTP POST to http://185.158.107.175:8787/_ah/dc with the package name, the machine's host name, the install directory, the current working directory and the Node.js version. Loading the package runs the same report again from index.js. The package then exports a stub that returns empty no-op functions for every member, in place of any real functionality. The package name copies a private organisation scope, and the version numbers are inflated (up to 99.0.x) so that a resolver which also queries the public registry prefers this copy. The same beacon and endpoint appear in @cecm-web-sdk/core. Impact: any developer or CI machine that installs or imports the package discloses its host name and internal directory layout to a third party, and the build gets a non-functional stub instead of the intended internal library. Remediation: remove the package, pin the scope to the private registry (for example a scoped registry entry in .npmrc), and review build hosts that installed it for unexpected connections to 185.158.107.175.