@ecg-internal/adobe-dmp-js

Package uses the `@ecg-internal/*` scope (resembling an internal namespace) and ships a minimal stub whose only effect is to beacon host identifiers to a hardcoded bare-IP endpoint. `package.json` declares a `postinstall` that runs `beacon.cjs`, which POSTs JSON containing `os.hostname()`, `__dirname` (install path), `process.cwd()`, Node version, and the package name to `http://185.158.107.175:8787/_ah/dc` over plain HTTP. The package `main` (`index.js`) also calls `require('./beacon.cjs').fire()` at top level, so the same callback fires on every `require`/`import`. `index.js` exports a `Proxy` no-op so property accesses on the module silently return functions, allowing consumer build pipelines to continue without errors and masking that the package is a stub. The hardcoded bare-IP destination over plain HTTP, unrelated to any legitimate Adobe or ECG infrastructure, together with the internal-looking scope and inert functional surface, is the canonical dependency-confusion reconnaissance payload used to map which victims resolved an attacker-published public package in place of a private internal one.