MAL-2026-14240

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dxr-dos/MAL-2026-14240.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14240
Published
2026-08-19T04:05:31Z
Modified
2026-08-19T04:30:10.956096853Z
Summary
Malicious code in dxr-dos (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3bad9a4bf59f5c59d899f7be2c655adaba56f8ce65f284519d9778ea1bcaff1f)

bin/dxr.js unconditionally requires the external npm package 'deathoffather-project' pinned to the mutable 'latest' tag and immediately invokes an opaque exported function whose name embeds a token blob and a Telegram-channel reference — handing arbitrary code execution to whatever that third-party dep currently ships on every invocation. The same entrypoint then shells out to 7z with a hardcoded password to unpack bin/b1n.zip into the working directory; the archive contains a bundled PHP C2 panel (serva/index.php) and related files. Password-protecting the shipped archive with a hardcoded password serves to hide contents from registry scanners rather than any legitimate distribution purpose. The package additionally advertises itself as an L4/L7 DDoS attack toolkit with a 'Create Panel C2' capability; offensive capability toward operator-chosen targets is not itself installer harm, but the mutable third-party dependency reached at CLI startup and the hidden extracted payload are.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T04:18:14.007103274Z",
            "sha256": "3bad9a4bf59f5c59d899f7be2c655adaba56f8ce65f284519d9778ea1bcaff1f",
            "modified_time": "2026-08-19T04:05:31Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018354",
            "versions": [
                "0.1.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dxr-dos

Package

Name
dxr-dos
View open source insights on deps.dev
Purl
pkg:npm/dxr-dos

Affected ranges

Affected versions

0.*
0.1.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dxr-dos/MAL-2026-14240.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "df1466279587e02141ff55804dad556ad684e6b0cfd5bd0a58c0cc0b74f6366c",
            "path": "bin/dxr.js",
            "tlsh": "f1d25360cfb511160b37e69cafeb8802e0168523a805fbb9b97c97950fd4414c8be9fd"
        },
        {
            "sha256": "b91c2a1628caf17e66f503b5d9a5ff908396d7d945c82535c670b7a2f7ec9f1e",
            "path": "package.json",
            "tlsh": "f6514625ce21c89b06d081819956420662a1ce070e84b41b7faf878ddb9e67f55ffa2d"
        }
    ],
    "package_integrity": [
        {
            "filename": "dxr-dos-0.1.2.tgz",
            "hashes": {
                "sha1": "bae2a71d6132580c8d539e33567acacc114f6a21",
                "sha512_sri": "sha512-cP8ZsrX5vlvmSvdrU0WixIsAyfwI4nppHxP3NQO4wrWMaL9DrXZJE/J3mEtxfORvfhMkQvGHBjIzK6PpVOw0cw=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]