vl-ui-code-preview@10.1.1

Analysis

Dependency-confusion package impersonating the Flemish government's @govflanders/vl-ui-code-preview library. The unscoped vl-ui-code-preview@10.1.1 ships a 55-byte placeholder index.js with no functional code. Both preinstall and postinstall hooks execute curl commands that exfiltrate system metadata (username via whoami, hostname, current working directory, and current timestamp) to the external endpoint hxxps://178fx66q[.]instances[.]httpworkbench[.]com/depconf/. The URL path /depconf/ and parameters (pkg, u, h, d, t) indicate targeted dependency-confusion reconnaissance measuring which environments are susceptible to the attack.