dxr-dos

{"modified":"2026-08-19T04:05:31Z","published":"2026-08-19T04:05:31Z","schema_version":"1.7.4","id":"MAL-2026-14240","summary":"Malicious code in dxr-dos (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3bad9a4bf59f5c59d899f7be2c655adaba56f8ce65f284519d9778ea1bcaff1f)\nbin/dxr.js unconditionally requires the external npm package 'deathoffather-project' pinned to the mutable 'latest' tag and immediately invokes an opaque exported function whose name embeds a token blob and a Telegram-channel reference — handing arbitrary code execution to whatever that third-party dep currently ships on every invocation. The same entrypoint then shells out to 7z with a hardcoded password to unpack bin/b1n.zip into the working directory; the archive contains a bundled PHP C2 panel (serva/index.php) and related files. Password-protecting the shipped archive with a hardcoded password serves to hide contents from registry scanners rather than any legitimate distribution purpose. The package additionally advertises itself as an L4/L7 DDoS attack toolkit with a 'Create Panel C2' capability; offensive capability toward operator-chosen targets is not itself installer harm, but the mutable third-party dependency reached at CLI startup and the hidden extracted payload are.\n","affected":[{"package":{"ecosystem":"npm","name":"dxr-dos"},"versions":["0.1.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"bin/dxr.js","sha256":"df1466279587e02141ff55804dad556ad684e6b0cfd5bd0a58c0cc0b74f6366c","tlsh":"f1d25360cfb511160b37e69cafeb8802e0168523a805fbb9b97c97950fd4414c8be9fd"},{"path":"package.json","sha256":"b91c2a1628caf17e66f503b5d9a5ff908396d7d945c82535c670b7a2f7ec9f1e","tlsh":"f6514625ce21c89b06d081819956420662a1ce070e84b41b7faf878ddb9e67f55ffa2d"}],"package_integrity":[{"filename":"dxr-dos-0.1.2.tgz","hashes":{"sha1":"bae2a71d6132580c8d539e33567acacc114f6a21","sha512_sri":"sha512-cP8ZsrX5vlvmSvdrU0WixIsAyfwI4nppHxP3NQO4wrWMaL9DrXZJE/J3mEtxfORvfhMkQvGHBjIzK6PpVOw0cw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dxr-dos/v/0.1.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018354","import_time":"2026-08-19T04:18:14.007103274Z","modified_time":"2026-08-19T04:05:31Z","sha256":"3bad9a4bf59f5c59d899f7be2c655adaba56f8ce65f284519d9778ea1bcaff1f","source":"amazon-inspector","versions":["0.1.2"]}]}}