vl-ui-button@10.1.1

Analysis

The package vl-ui-button@10.1.1 is a combosquat of the legitimate @vl-ui/button package that contains no real functionality. Both its preinstall and postinstall lifecycle hooks send an HTTP GET request to 178fx66q[.]instances[.]httpworkbench[.]com with the installer's username (`whoami`), hostname, current working directory, and a timestamp collected as query parameters. The output of the curl commands is discarded to /dev/null and errors are masked with `|| true` for stealth. The host is an HTTP Workbench instance acting as a webhook receiver for attacker collection. This is a dependency-confusion reconnaissance beacon designed to identify systems that install it.