Malicious code in dxr-dos (npm)

The dxr-dos npm package version 0.1.2 contains malicious code that unconditionally imports the external npm package 'deathoffather-project' pinned to the mutable 'latest' tag. This dependency immediately executes an opaque function referencing a token and a Telegram channel, enabling arbitrary code execution from the third-party package on every invocation. Additionally, the package shells out to 7z with a hardcoded password to extract a bundled PHP C2 panel and related files from a password-protected archive, which serves to hide the payload from registry scanners. The package advertises itself as an L4/L7 DDoS attack toolkit with a 'Create Panel C2' feature. The mutable dependency and hidden payload introduce significant security risks beyond the offensive capabilities advertised.

Users running dxr-dos version 0.1.2 are exposed to arbitrary code execution via a mutable third-party dependency that is invoked at CLI startup. The extraction and deployment of a hidden PHP C2 panel further enable command and control capabilities on the compromised system. This can lead to unauthorized control, potential use in DDoS attacks, and other malicious activities. The hardcoded password and obfuscation techniques hinder detection by automated scanners.

No official patch or remediation is currently documented. Users should avoid using dxr-dos version 0.1.2 due to its malicious behavior. Since the package relies on a mutable third-party dependency, removing or blocking the 'deathoffather-project' package or avoiding the dxr-dos package altogether is recommended. Monitor for updates from the package maintainers or npm advisories for any official fixes. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.