Malicious code in dxr-dos (npm)
The npm package dxr-dos contains malicious code that executes arbitrary code via a mutable third-party dependency (deathoffather-project) and extracts a hidden PHP C2 panel from a password-protected archive. The package is advertised as a DDoS toolkit with command-and-control capabilities.
- Disclosed
- Last updated
- Blast radius
- Any user installing and executing dxr-dos on their system gains arbitrary code execution through the mutable third-party dependency and hidden payload extraction.
- Ecosystems
- Attack vectors
- Affected entities
- dxr-dosnpm package containing malicious code
The npm package dxr-dos was found to contain malicious code designed to provide arbitrary code execution and command-and-control capabilities. Upon invocation, the package's bin/dxr.js entry point unconditionally requires an external npm package 'deathoffather-project' pinned to the mutable 'latest' tag and immediately invokes an opaque exported function, handing arbitrary code execution to whatever that third-party dependency currently ships.\n\nThe same entry point shells out to 7z with a hardcoded password to unpack bin/b1n.zip into the working directory. The archive contains a bundled PHP C2 panel (serva/index.php) and related files. The password protection of the shipped archive serves to hide contents from registry scanners rather than any legitimate distribution purpose.\n\nThe package advertises itself as an L4/L7 DDoS attack toolkit with a 'Create Panel C2' capability. The combination of the mutable third-party dependency reached at CLI startup and the hidden extracted payload constitutes installer harm to any user executing the package.\n\nThe incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- dxr-dos
- deathoffather-project
Remediation
- Remove dxr-dos from all systems and environments
- Audit systems that installed or executed dxr-dos for signs of compromise or unauthorized access
- Review network logs for connections to the referenced Telegram channel or C2 infrastructure
- Ensure npm package dependencies are regularly audited for malicious code
- Use npm security tools and registry scanners to detect similar hidden payloads
Sources
- GitHub Advisory GHSA-qpr3-hr2q-fprv · GitHub Advisory Database
Cite this entry
"Malicious code in dxr-dos (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-dxr-dos-npm-kgl99o
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in localize-translate (npm)
The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.
npmCompromised packageMalicious commit - containedcritical
Malicious code in mutex-plus (npm)
The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.
npmCompromised packageMalicious commit