Malicious code in dxrs-dos (npm)

The dxrs-dos npm package (version 0.1.3) is a malicious DDoS/booter toolkit that executes harmful actions immediately upon module load. It depends on an unpinned, author-controlled package 'deathoffather-project' at the 'latest' version, which allows the author to execute arbitrary code on every load. Additionally, if a specific file is missing, it extracts a password-protected 64KB archive containing a PHP command-and-control panel into the current working directory. The attack payloads themselves are obfuscated single-line scripts that only run when explicitly triggered by the operator. The load-time behaviors provide the author with a persistent live channel for arbitrary code execution and payload deployment without user interaction.

This package enables the author to execute arbitrary code on any system that installs or requires it, without operator consent. It also drops a concealed command-and-control panel into the working directory, potentially facilitating remote control and further malicious activities. The presence of obfuscated payloads indicates a high risk of unauthorized system compromise and misuse for DDoS attacks or botnet operations.

No official patch or remediation is currently available. Users should immediately uninstall and avoid using the dxrs-dos package version 0.1.3. Since the package executes arbitrary code from an unpinned dependency and drops opaque payloads, it should be considered malicious and removed from all environments. Monitor for any presence of the password-protected archive or related files in working directories and clean affected systems accordingly.