dtxto1ols@1.0.2

Analysis

A trojanized string-utility package. The published source code (index.js) contains benign functions (camelToKebab, slugify, truncate, etc.) as camouflage, while the postinstall hook performs host reconnaissance and data exfiltration. On install, the shell script scans the filesystem for database client binaries (mysql, mongo, mongosh, psql, redis-cli, sqlite3, elasticsearch) and writes the results to /data/db_clients_check.txt. It then sends the data via HTTP POST to the external endpoint hxxp://3dhd6wwmusbh04m22igmzvb4hvnmblza[.]oastify[.]com/data/db_clients_check[.]txt. The oastify[.]com domain is an attacker-controlled exfiltration callback server. The package has no repository URL and no homepage.