The dtxtools npm package versions 1.0.0 and 1.0.1 contain malicious code that executes during installation. Specifically, a postinstall script performs a recursive search for database client binaries on the filesystem and exfiltrates the findings via an unencrypted HTTP request to an attacker-controlled domain. The package disguises itself as a benign string utility library but conducts unauthorized reconnaissance and data exfiltration unrelated to its advertised functionality. The author and repository metadata are empty, indicating a disposable or decoy package. No official patch or remediation is currently documented.