@harris yes I’d be happy to collaborate with you (and anyone else) on improving the ddust tool and/or further exploring mitigations for this issue.
As for attack detection logic the tool already finds any dust size UTXOs in your (pub key descriptor) wallet. And it should work with any hardware signers that can sign a PSBT, but I haven’t done much testing on that front.
Figuring out how to combine unconfirmed dust disposal transactions is my current focus so we can start there. First try building and testing the project with a regtest bitcoind node. Then I recommend getting to know how the bdk_wallet and bdk_bitcoind_rpc rust crates work, they do most of the heavy lifting.