vl-ui-contact-card@10.1.1

Analysis

vl-ui-contact-card@10.1.1 is a dependency-confusion reconnaissance beacon. Both preinstall and postinstall lifecycle hooks run curl to exfiltrate host metadata — username (whoami), hostname, current working directory, and timestamp — to the remote host 178fx66q[.]instances[.]httpworkbench[.]com via the URL path /depconf/. The package contains no functional code: index.js is a single-line comment stub. The description "A simple, benign placeholder for npm." and the || true error suppression are designed to mask the recon activity and silently succeed regardless of network failure.