MAL-2026-14240 Malicious code in dxr-dos (npm)

bin/dxr.js unconditionally requires the external npm package 'deathoffather-project' pinned to the mutable 'latest' tag and immediately invokes an opaque exported function whose name embeds a token blob and a Telegram-channel reference — handing arbitrary code execution to whatever that third-party dep currently ships on every invocation. The same entrypoint then shells out to 7z with a hardcoded password to unpack bin/b1n.zip into the working directory; the archive contains a bundled PHP C2 panel (serva/index.php) and related files. Password-protecting the shipped archive with a hardcoded password serves to hide contents from registry scanners rather than any legitimate distribution purpose. The package additionally advertises itself as an L4/L7 DDoS attack toolkit with a 'Create Panel C2' capability; offensive capability toward operator-chosen targets is not itself installer harm, but the mutable third-party dependency reached at CLI startup and the hidden extracted payload are.