dtxtools@1.0.0

Analysis

dtxtools@1.0.0 is a trojanized string-utility library. On npm install, its postinstall hook scans the filesystem for database client binaries (mysql, mongo, mongosh, psql, redis-cli, sqlite3, elasticsearch) and POSTs the findings to hxxp://3dhd6wwmusbh04m22igmzvb4hvnmblza[.]oastify[.]com/data/db_clients_check[.]txt. The hook performs this via a find command piped to curl exfiltration. The package's index.js contains benign string helpers (camelToKebab, slugify, etc.) as a decoy; the malicious behaviour runs from the lifecycle hook at install time regardless.