What does the dxrs-dos malware do?

Package is an openly-advertised DDoS/booter toolkit (L4/L7 flood methods, SSH brute force, C2 panel builder) with keywords such as "ddos attack script", "layer 4 ddos", "layer 7 ddos", "booter script", and "cnc botnet". The declared main bin/dxr.js has two behaviors that fire at module load (require or CLI invocation), before the operator selects any attack: 1. It requires the dependency `deathoffather-project` pinned to `"latest"` — an unpinned, author-controlled npm package — and immediately invokes an exported function on it (`deathoffather.protect_license_[...]()`). Because the version is `latest` and the dependency is controlled by the same author, arbitrary code the author publishes t

Which versions of dxrs-dos are malicious?

The following npm versions of dxrs-dos are flagged malicious: 0.1.3. Treat any of these as compromised.

How do I remediate dxrs-dos if I installed it?

dxrs-dos establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

I already installed dxrs-dos — how do I know if it already compromised me?

If dxrs-dos was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is dxrs-dos part of a known attack campaign?

Yes — dxrs-dos is associated with the IN-MAL-2026-018355 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find dxrs-dos across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for dxrs-dos (version 0.1.3).

Malicious package

dxrs-dosnpm

dxrs-dos is a confirmed malicious npm package (MAL-2026-14241) that opens a backdoor for remote access (malicious version 0.1.3). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in dxrs-dos (npm)

MAL-2026-14241

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall dxrs-dos

What this malware does

Package is an openly-advertised DDoS/booter toolkit (L4/L7 flood methods, SSH brute force, C2 panel builder) with keywords such as "ddos attack script", "layer 4 ddos", "layer 7 ddos", "booter script", and "cnc botnet". The declared main bin/dxr.js has two behaviors that fire at module load (require or CLI invocation), before the operator selects any attack:

It requires the dependency deathoffather-project pinned to "latest" — an unpinned, author-controlled npm package — and immediately invokes an exported function on it (deathoffather.protect_license_[...]()). Because the version is latest and the dependency is controlled by the same author, arbitrary code the author publishes to that dependency executes on every load of dxrs-dos.
If ./serva is not present in the caller's cwd, it shell-invokes 7z x./b1n.zip -p<password> -o. -y to extract a password-protected 64KB archive shipped inside the tarball (described as a PHP C2 panel) into the caller's cwd. The archive is opaque to content scanning due to the password.

The attack payloads themselves (H2Rapid.js, H2Ryuk.js, MReset.js, tankSyn.js, udpGod.js, killSSH.js, etc.) are 150–500KB single-line files using invisible Hangul-filler unicode identifiers and hex/unicode-escaped string arrays, and reconstruct URLs such as http://ip-api.com/json/${__TextDecoder} at runtime; those fire only on explicit operator invocation. The load-time behaviors above do not require operator consent and give the author a live channel to run arbitrary code and drop opaque payloads into the installer's working directory.

Malicious versions

1 flagged

0.1.3

Indicators of compromise (SHA-256)

1634fc433b5cd1e5e4baa139e8795b6b6ef51bb80fdbdc5183fb7fed419aee33

Detection & response playbook

Backdoor / remote access

Find it
Search your lockfiles and build artifacts for dxrs-dos (version 0.1.3).
If you installed it — respond
dxrs-dos establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If dxrs-dos was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. dxrs-dos on npm has been identified as a malicious package (version 0.1.3 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-018355

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks dxrs-dos-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database