MAL-2026-6498

Dashboard / Malicious Package / MAL-2026-6498

MAL-2026-6498

Summary: Malicious code in dttfdsdee (npm)

Details: Source: amazon-inspector (ae565bed85ec0db27f1ff658c7e9491591ce40edc56f423cd8b1122bc209c69c) package.json declares a postinstall script that runs automatically on npm install. The script walks the entire filesystem with find to locate database client binaries (mysql, mongo, mongosh, psql, redis-cli, sqlite3, elasticsearch), writes the results to /data/db_clients_check.txt, and then uses curl -X POST to send local file contents to an out-of-band callback at http://3dhd6wwmusbh04m22igmzvb4hvnmblza.oastify.com (oastify.com is the Burp Collaborator OOB interaction domain). The package presents itself as a generic string-utility helper with benign filler in index.js, but the advertised purpose is wholly inconsistent with the install-time behavior; metadata is hollow (empty author, empty repository, empty homepage) and the name is a random string — consistent with disposable reconnaissance bait. Installing the package on a developer or CI machine causes immediate filesystem reconnaissance and exfiltration to attacker-controlled infrastructure. Source: ossf-package-analysis (bb785783c80ff1b3c13e9d6dc3b3c583d2eeb58f9f7f102d219a7448a71560b5) The OpenSSF Package Analysis project identified 'dttfdsdee' @ 1.0.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.

References: https://www.npmjs.com/package/dttfdsdee/v/1.0.3, https://www.npmjs.com/package/dttfdsdee/v/1.0.4, https://www.npmjs.com/package/dttfdsdee/v/1.0.1, https://www.npmjs.com/package/dttfdsdee/v/1.0.0, https://www.npmjs.com/package/dttfdsdee/v/1.0.2, https://www.npmjs.com/package/dttfdsdee/v/1.0.6, https://www.npmjs.com/package/dttfdsdee/v/1.0.5