@ecg-internal/favourites-ui@1.1.0

The package publishes under the internal-looking scope `@ecg-internal/` and ships a `postinstall` script (`beacon.cjs`) plus a top-level `require()` side effect in `index.js` that call a `fire()` function. `fire()` POSTs a JSON payload containing `os.hostname()`, the install `__dirname`, `process.cwd()`, and the Node version to the hardcoded bare-IP endpoint `http://185.158.107.175:8787/_ah/dc` over plain HTTP. `index.js` otherwise exports a `Proxy` whose property access returns a no-op function, and an in-source comment states that 'a build that completes and calls back is cleaner evidence' — the module provides no real functionality and exists only to produce an install-time callback. The combination of an internal-scope name, a stub module, and an automatic bare-IP beacon carrying installer host identifiers is a dependency-confusion probe: build pipelines that mistakenly resolve this public package instead of the intended private `@ecg-internal/favourites-ui` disclose internal hostnames and build-path information to the operator of 185.158.107.175.