vl-ui-action-group@10.1.1

Analysis

vl-ui-action-group@10.1.1 is a dependency-confusion recon package. Both the preinstall and postinstall hooks execute curl to send host reconnaissance data to hxxps://178fx66q[.]instances[.]httpworkbench[.]com/depconf/ via GET query parameters. The exfiltrated data includes the package name, the current username ($(whoami)), hostname ($(hostname)), working directory ($PWD), and install timestamp ($(date +%s)). The package's index.js is an empty stub and the description is misleading — the package has no real functionality beyond these data-gathering lifecycle hooks.