vl-ui-breadcrumb@10.1.1

Analysis

Installing this package triggers both preinstall and postinstall hooks that curl a remote server at 178fx66q[.]instances[.]httpworkbench[.]com with host recon data: the current username (whoami), hostname, working directory ($PWD), and install timestamp. The URL path /depconf/ and the package name (tailored to collide with a real UI component library namespace) indicate a targeted dependency-confusion attack. The package contains no functional code — index.js is an empty stub.