Is @ppa-web-components/ppa-hotel-collection malicious?

Dependency-confusion package sends hostname and install paths to a remote server at install time

@ppa-web-components/ppa-hotel-collection 2.0.1 is published under a name that matches a private internal package scope, at artificially high or unusual versions, so that build systems resolving the internal name from the public registry install it instead. Its package.json runs node beacon.cjs as a postinstall script. The script sends an HTTP POST to http://185.158.107.175:8787/_ah/dc with the package name, the machine's hostname, the install directory, the current working directory and the Node.js version, tagged with an x-beacon-package header. The package's entry point sends the same request again whenever it is loaded, and otherwise exports an empty stub, so the package has no legitimate functionality. Impact: any developer or CI machine that installs it discloses its hostname and filesystem layout to a third party, and confirms that the internal package name resolves from the public registry, which enables follow-up attacks with a harmful payload. Remediation: remove the package, scope internal package names to a private registry (or pin the scope to it), install with --ignore-scripts where possible, and block 185.158.107.175 on build hosts.