The npm package 'dttfdsdee' versions 1.0.0 through 1.0.6 contains malicious code that executes automatically upon installation. It performs filesystem reconnaissance to locate database client binaries and exfiltrates the collected data to an attacker-controlled external server. The package masquerades as a benign utility but exhibits behavior inconsistent with its advertised purpose, indicating it is designed as disposable reconnaissance bait.