Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in dxrs-dos (npm)

The npm package dxrs-dos is an openly-advertised DDoS/booter toolkit that executes malicious code on module load. It uses an unpinned dependency (deathoffather-project) for arbitrary code execution and extracts a password-protected PHP C2 panel archive into the caller's working directory.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer or system that installs or requires the dxrs-dos npm package
Ecosystems
npm
Attack vectors
Compromised packageMalicious commit
Affected entities
  • dxrs-dosnpm package containing malicious DDoS/booter toolkit code
  • deathoffather-projectdependency pinned to 'latest' used for code injection

The npm package dxrs-dos is a malicious DDoS/booter toolkit advertised with keywords including "ddos attack script", "layer 4 ddos", "layer 7 ddos", "booter script", and "cnc botnet". The package implements L4/L7 flood methods, SSH brute force, and C2 panel builder functionality.

The package exhibits two malicious behaviors that execute automatically on module load, before any user interaction:

  1. Unpinned dependency injection: The main entry point (bin/dxr.js) requires the dependency deathoffather-project pinned to "latest" and immediately invokes an exported function. Because the version is unpinned and controlled by the same author, any code published to that dependency executes automatically on every load of dxrs-dos.

  2. Opaque archive extraction: If ./serva is not present in the caller's current working directory, the package shell-invokes 7z x./b1n.zip -p -o. -y to extract a password-protected 64KB archive (described as a PHP C2 panel) into the caller's working directory. The password protection prevents content scanning.

The attack payloads (H2Rapid.js, H2Ryuk.js, MReset.js, tankSyn.js, udpGod.js, killSSH.js, etc.) are obfuscated using invisible Hangul-filler unicode identifiers and hex/unicode-escaped string arrays, reconstructing URLs at runtime to avoid static detection.

Indicators of compromise

Packages
  • dxrs-dos
  • deathoffather-project

Remediation

  • Immediately uninstall dxrs-dos and any versions of deathoffather-project from all systems
  • Audit npm package.json files and lock files for any references to dxrs-dos or deathoffather-project
  • Review system logs and network traffic for indicators of DDoS activity or C2 communication originating from affected systems
  • If the package was installed, inspect the current working directory for the presence of ./serva or extracted C2 panel files
  • Update npm to the latest version and run 'npm audit' to identify any remaining compromised dependencies
  • Consider implementing npm package allowlisting or private registry policies to prevent installation of malicious packages

Sources

  1. GitHub Advisory GHSA-8q24-cmxm-rvr4 · GitHub Advisory Database

Cite this entry

"Malicious code in dxrs-dos (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-dxrs-dos-npm-75eay1

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in rust-testing-utils (npm)

    The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.

    npmCompromised packageMalicious commit
  2. resolvedcritical

    Malicious code in @syncraft-labs/core (npm)

    The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.

    npmCompromised packageMalicious commit
  3. resolvedcritical

    Malicious code in localize-translate (npm)

    The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.

    npmCompromised packageMalicious commit
  4. containedcritical

    Malicious code in mutex-plus (npm)

    The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.

    npmCompromised packageMalicious commit