@ecg-internal/media-util-js-lib@2.0.0

The package publishes to the public npm registry under the scoped name `@ecg-internal/media-util-js-lib`, which resembles an internal namespace. It ships no real functionality — the main entry exports a Proxy stub returning no-ops for every property, described as a 'Compatibility shim.' Both `package.json` `postinstall` (`node beacon.cjs`) and the main module invoke `fire()` in `beacon.cjs`, which POSTs the installer's hostname (`os.hostname()`), install path (`__dirname`), current working directory (`process.cwd()`), Node version, and package name to the hardcoded bare-IP endpoint `http://185.158.107.175:8787/_ah/dc` over cleartext HTTP. The beacon fires on `npm install` without user action and again whenever the module is required, so any internal build system misconfigured to resolve this public artifact for an `@ecg-internal/*` dependency transmits identifying host and path information to the attacker-controlled endpoint. The 'build-provenance beacon' comment in the source is a cover story inconsistent with the hardcoded bare-IP destination unrelated to any legitimate publisher infrastructure.