{"answers":{"affected":"1 open source package ship an affected version, including dxrs-dos.","exploited":"There is no known exploitation of MAL-2026-14241 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-14241 is a malicious package in dxrs-dos, published on 19 Aug 2026."},"fix_prompt":"MAL-2026-14241 is a malicious package: dxrs-dos (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-14241/ (Markdown: https://insights.sbomify.com/MAL-2026-14241/index.md)","id":"MAL-2026-14241","markdown":"https://insights.sbomify.com/MAL-2026-14241/index.md","name":"MAL-2026-14241","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package is an openly-advertised DDoS/booter toolkit (L4/L7 flood methods, SSH brute force, C2 panel builder) with keywords such as \"ddos attack script\", \"layer 4 ddos\", \"layer 7 ddos\", \"booter script\", and \"cnc botnet\". The declared main bin/dxr.js has two behaviors that fire at module load (require or CLI invocation), before the operator selects any attack:\n\n1. It requires the dependency `deathoffather-project` pinned to `\"latest\"` — an unpinned, author-controlled npm package — and immediately invokes an exported function on it (`deathoffather.protect_license_[...]()`). Because the version is `latest` and the dependency is controlled by the same author, arbitrary code the author publishes to that dependency executes on every load of dxrs-dos.\n\n2. If `./serva` is not present in the caller's cwd, it shell-invokes `7z x./b1n.zip -p\u003cpassword\u003e -o. -y` to extract a password-protected 64KB archive shipped inside the tarball (described as a PHP C2 panel) into the caller's cwd. The archive is opaque to content scanning due to the password.\n\nThe attack payloads themselves (H2Rapid.js, H2Ryuk.js, MReset.js, tankSyn.js, udpGod.js, killSSH.js, etc.) are 150–500KB single-line files using invisible Hangul-filler unicode identifiers and hex/unicode-escaped string arrays, and reconstruct URLs such as `http://ip-api.com/json/${__TextDecoder}` at runtime; those fire only on explicit operator invocation. The load-time behaviors above do not require operator consent and give the author a live channel to run arbitrary code and drop opaque payloads into the installer's working directory.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in dxrs-dos (npm)","id":"MAL-2026-14241","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"dxrs-dos","purl":"pkg:npm/dxrs-dos","source":"MAL-2026-14241"}],"products":null,"published":"2026-08-19","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-14241/"}