MAL-2026-14241 Malicious code in dxrs-dos (npm)

Package is an openly-advertised DDoS/booter toolkit (L4/L7 flood methods, SSH brute force, C2 panel builder) with keywords such as "ddos attack script", "layer 4 ddos", "layer 7 ddos", "booter script", and "cnc botnet". The declared main bin/dxr.js has two behaviors that fire at module load (require or CLI invocation), before the operator selects any attack:

1. It requires the dependency deathoffather-project pinned to "latest" — an unpinned, author-controlled npm package — and immediately invokes an exported function on it (deathoffather.protect_license_[...]()). Because the version is latest and the dependency is controlled by the same author, arbitrary code the author publishes to that dependency executes on every load of dxrs-dos.

2. If ./serva is not present in the caller's cwd, it shell-invokes 7z x./b1n.zip -p<password> -o. -y to extract a password-protected 64KB archive shipped inside the tarball (described as a PHP C2 panel) into the caller's cwd. The archive is opaque to content scanning due to the password.

The attack payloads themselves (H2Rapid.js, H2Ryuk.js, MReset.js, tankSyn.js, udpGod.js, killSSH.js, etc.) are 150–500KB single-line files using invisible Hangul-filler unicode identifiers and hex/unicode-escaped string arrays, and reconstruct URLs such as http://ip-api.com/json/${__TextDecoder} at runtime; those fire only on explicit operator invocation. The load-time behaviors above do not require operator consent and give the author a live channel to run arbitrary code and drop opaque payloads into the installer's working directory.