dttfdsdee@1.0.1

Analysis

On package install, the postinstall lifecycle hook executes a curl command that recursively lists the contents of the /data/ directory ($(ls -laR /data/)) and POSTs the output as the request body to a remote host at 3dhd6wwmusbh04m22igmzvb4hvnmblza[.]oastify[.]com via HTTP. The oastify[.]com domain is an out-of-band application security testing (OAST) callback server operated as an exfiltration sink. This reconnaissance payload allows the attacker to confirm execution on the target and map filesystem contents under /data/. The package's published source code (index.js) contains benign string utility functions (camelToKebab, slugify, truncate, etc.) that serve as a decoy; the malicious behaviour is entirely in the postinstall hook defined in package.json.