The dtxtools package versions 1.0.0 and 1.0.1 on npm include a postinstall lifecycle script that automatically runs upon installation. This script searches recursively for database client binaries such as mysql, mongo, mongosh, psql, redis-cli, sqlite3, and elasticsearch on the victim's filesystem. It writes the results to a local file and then sends this information via plain HTTP POST to a Burp Collaborator (OAST) domain controlled by an attacker. The package's metadata fields like author, repository, bugs, and homepage are empty, consistent with a disposable or malicious decoy package. The package advertises itself as a string utility library but performs unauthorized reconnaissance and data exfiltration during installation. This behavior was identified by Amazon Inspector and the OpenSSF Package Analysis project, which flagged the package as malicious.

The malicious postinstall script can lead to unauthorized reconnaissance of the victim's environment by identifying installed database clients. The exfiltration of this information to an attacker-controlled domain can facilitate further targeted attacks or data breaches. Since the data is sent over unencrypted HTTP, it also exposes the victim to potential interception. The presence of such a package in a software supply chain can compromise system confidentiality and integrity. There is no indication of remote code execution beyond the postinstall script or persistence mechanisms, but the reconnaissance and data leakage alone represent a significant security risk.

No official patch or remediation is currently documented for dtxtools versions 1.0.0 and 1.0.1. Users and organizations should avoid installing or using these versions of the dtxtools package. It is recommended to audit dependencies for the presence of dtxtools and remove or replace it with a trusted alternative. Monitor package sources carefully and prefer packages with verified authorship and metadata. Since this is not a cloud service, remediation depends on user action to remove or avoid the malicious package. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.