MAL-2026-14241

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dxrs-dos/MAL-2026-14241.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14241
Published
2026-08-19T04:05:41Z
Modified
2026-08-19T04:30:12.239530103Z
Summary
Malicious code in dxrs-dos (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1634fc433b5cd1e5e4baa139e8795b6b6ef51bb80fdbdc5183fb7fed419aee33)

Package is an openly-advertised DDoS/booter toolkit (L4/L7 flood methods, SSH brute force, C2 panel builder) with keywords such as "ddos attack script", "layer 4 ddos", "layer 7 ddos", "booter script", and "cnc botnet". The declared main bin/dxr.js has two behaviors that fire at module load (require or CLI invocation), before the operator selects any attack:

  1. It requires the dependency deathoffather-project pinned to "latest" — an unpinned, author-controlled npm package — and immediately invokes an exported function on it (deathoffather.protect_license_[...]()). Because the version is latest and the dependency is controlled by the same author, arbitrary code the author publishes to that dependency executes on every load of dxrs-dos.

  2. If ./serva is not present in the caller's cwd, it shell-invokes 7z x./b1n.zip -p<password> -o. -y to extract a password-protected 64KB archive shipped inside the tarball (described as a PHP C2 panel) into the caller's cwd. The archive is opaque to content scanning due to the password.

The attack payloads themselves (H2Rapid.js, H2Ryuk.js, MReset.js, tankSyn.js, udpGod.js, killSSH.js, etc.) are 150–500KB single-line files using invisible Hangul-filler unicode identifiers and hex/unicode-escaped string arrays, and reconstruct URLs such as http://ip-api.com/json/${__TextDecoder} at runtime; those fire only on explicit operator invocation. The load-time behaviors above do not require operator consent and give the author a live channel to run arbitrary code and drop opaque payloads into the installer's working directory.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T04:18:14.074296241Z",
            "sha256": "1634fc433b5cd1e5e4baa139e8795b6b6ef51bb80fdbdc5183fb7fed419aee33",
            "modified_time": "2026-08-19T04:05:41Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018355",
            "versions": [
                "0.1.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dxrs-dos

Package

Name
dxrs-dos
View open source insights on deps.dev
Purl
pkg:npm/dxrs-dos

Affected ranges

Affected versions

0.*
0.1.3

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dxrs-dos/MAL-2026-14241.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "2f4059f3709c6a39cdc168fc482b1e5ab6fd2d45128b18b351f9bca88e0d2063",
            "tlsh": "40516825cf21cc9b06d081899965420663a0c6070e80b41b7f9787cddfae67f95ffa2d",
            "path": "package.json"
        },
        {
            "sha256": "39df65a28d9af87329fc7a332cd36ae9bf81ba1089c4743cc3296feeadd98958",
            "tlsh": "86d25360cfb511160b37e69dafeb8802e0168523a805fbb9b97c93950fd4414c8be9fd",
            "path": "bin/dxr.js"
        },
        {
            "sha256": "2cba79fdec32560a5370889d55657fa37d8bbb666ff9b5bfcece52a765ff0937",
            "path": "bin/H2Rapid.js",
            "tlsh": "e394e740a51f90db56ce2acd7bb1cd04921e3e70c876d262bfca96bf9d142e4cca815d"
        }
    ],
    "package_integrity": [
        {
            "filename": "dxrs-dos-0.1.3.tgz",
            "hashes": {
                "sha1": "9264e20bddc61d22ac26ff8f73e89e1fddf10c53",
                "sha512_sri": "sha512-IKbwSQO8xUHvOHWdjt96unHzSZRn4szZ02wqiURxrDdqK4ormodEtjn0ONN+KAW7rwDKFG8tSSIt0CHEyUp4JQ=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]