MAL-2026-6498 Malicious code in dttfdsdee (npm)

package.json declares a postinstall script that runs automatically on npm install. The script walks the entire filesystem with find to locate database client binaries (mysql, mongo, mongosh, psql, redis-cli, sqlite3, elasticsearch), writes the results to /data/db_clients_check.txt, and then uses curl -X POST to send local file contents to an out-of-band callback at http://3dhd6wwmusbh04m22igmzvb4hvnmblza.oastify.com (oastify.com is the Burp Collaborator OOB interaction domain). The package presents itself as a generic string-utility helper with benign filler in index.js, but the advertised purpose is wholly inconsistent with the install-time behavior; metadata is hollow (empty author, empty repository, empty homepage) and the name is a random string — consistent with disposable reconnaissance bait. Installing the package on a developer or CI machine causes immediate filesystem reconnaissance and exfiltration to attacker-controlled infrastructure.

The OpenSSF Package Analysis project identified 'dttfdsdee' @ 1.0.1 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.

• The package executes one or more commands associated with malicious behavior.