MAL-2026-14240

    Dashboard / Malicious Package / MAL-2026-14240

    MAL-2026-14240

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in dxr-dos (npm)

    Details: Source: amazon-inspector (3bad9a4bf59f5c59d899f7be2c655adaba56f8ce65f284519d9778ea1bcaff1f) bin/dxr.js unconditionally requires the external npm package 'deathoffather-project' pinned to the mutable 'latest' tag and immediately invokes an opaque exported function whose name embeds a token blob and a Telegram-channel reference — handing arbitrary code execution to whatever that third-party dep currently ships on every invocation. The same entrypoint then shells out to 7z with a hardcoded password to unpack bin/b1n.zip into the working directory; the archive contains a bundled PHP C2 panel (serva/index.php) and related files. Password-protecting the shipped archive with a hardcoded password serves to hide contents from registry scanners rather than any legitimate distribution purpose. The package additionally advertises itself as an L4/L7 DDoS attack toolkit with a 'Create Panel C2' capability; offensive capability toward operator-chosen targets is not itself installer harm, but the mutable third-party dependency reached at CLI startup and the hidden extracted payload are.

    References: https://www.npmjs.com/package/dxr-dos/v/0.1.2

    Affected packages

    Package

    Name: dxr-dos

    Purl: pkg:npm/dxr-dos

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.1.2
    MAL-2026-14240 | CVE-DB