dtxtools (npm) · Malicious Code
Affects dtxtoolsSource GCVE Database
Malicious package : remove dtxtools and rotate any secrets on hosts that installed it.
Data as of 26 Jun 2026, 22:19 UTC
Malicious package
Published to npm · OSV MAL-2026-6514
What to do
Remove dtxtools from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmdtxtools | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The dtxtools npm package versions 1.0.0 and 1.0.1 contain malicious code that executes during installation. Specifically, a postinstall script performs a recursive search for database client binaries on the filesystem and exfiltrates the findings via an unencrypted HTTP request to an attacker-controlled domain. The package disguises itself as a benign string utility library but conducts unauthorized reconnaissance and data exfiltration unrelated to its advertised functionality. The author and repository metadata are empty, indicating a disposable or decoy package. No official patch or remediation is currently documented.