# MAL-2026-14241: Malicious code in dxrs-dos (npm)


- **Type:** Malicious package
- **Package:** `dxrs-dos` (npm)
- **Published:** 19 Aug 2026

## What is MAL-2026-14241?

MAL-2026-14241 is a malicious package in dxrs-dos, published on 19 Aug 2026. 

### Official description

Package is an openly-advertised DDoS/booter toolkit (L4/L7 flood methods, SSH brute force, C2 panel builder) with keywords such as "ddos attack script", "layer 4 ddos", "layer 7 ddos", "booter script", and "cnc botnet". The declared main bin/dxr.js has two behaviors that fire at module load (require or CLI invocation), before the operator selects any attack:

1. It requires the dependency `deathoffather-project` pinned to `"latest"` — an unpinned, author-controlled npm package — and immediately invokes an exported function on it (`deathoffather.protect_license_[...]()`). Because the version is `latest` and the dependency is controlled by the same author, arbitrary code the author publishes to that dependency executes on every load of dxrs-dos.

2. If `./serva` is not present in the caller's cwd, it shell-invokes `7z x./b1n.zip -p<password> -o. -y` to extract a password-protected 64KB archive shipped inside the tarball (described as a PHP C2 panel) into the caller's cwd. The archive is opaque to content scanning due to the password.

The attack payloads themselves (H2Rapid.js, H2Ryuk.js, MReset.js, tankSyn.js, udpGod.js, killSSH.js, etc.) are 150–500KB single-line files using invisible Hangul-filler unicode identifiers and hex/unicode-escaped string arrays, and reconstruct URLs such as `http://ip-api.com/json/${__TextDecoder}` at runtime; those fire only on explicit operator invocation. The load-time behaviors above do not require operator consent and give the author a live channel to run arbitrary code and drop opaque payloads into the installer's working directory.

## What should I do about MAL-2026-14241?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-14241 is a malicious package: dxrs-dos (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-14241/ (Markdown: https://insights.sbomify.com/MAL-2026-14241/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-14241

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-14241/
Summaries are generated and may contain mistakes; the official description above is the record.