GCVE-110-OSM-2026-10602

Package is an openly-advertised DDoS/booter toolkit (L4/L7 flood methods, SSH brute force, C2 panel builder) with keywords such as "ddos attack script", "layer 4 ddos", "layer 7 ddos", "booter script", and "cnc botnet". The declared main bin/dxr.js has two behaviors that fire at module load (require or CLI invocation), before the operator selects any attack: 1. It requires the dependency `deathoffather-project` pinned to `"latest"` — an unpinned, author-controlled npm package — and immediately invokes an exported function on it (`deathoffather.protect_license_[...]()`). Because the version is `latest` and the dependency is controlled by the same author, arbitrary code the author publishes to that dependency executes on every load of dxrs-dos. 2. If `./serva` is not present in the caller's cwd, it shell-invokes `7z x./b1n.zip -p<password> -o. -y` to extract a password-protected 64KB archive shipped inside the tarball (described as a PHP C2 panel) into the caller's cwd. The archive is opaque to content scanning due to the password. The attack payloads themselves (H2Rapid.js, H2Ryuk.js, MReset.js, tankSyn.js, udpGod.js, killSSH.js, etc.) are 150–500KB single-line files using invisible Hangul-filler unicode identifiers and hex/unicode-escaped string arrays, and reconstruct URLs such as `http://ip-api.com/json/${__TextDecoder}` at runtime; those fire only on explicit operator invocation. The load-time behaviors above do not require operator consent and give the author a live channel to run arbitrary code and drop opaque payloads into the installer's working directory. Judge assessment: This package is a DDoS/booter toolkit authored to execute attacker-controlled payloads, not a benign library. The entrypoint `bin/dxr.js` immediately requires `deathoffather-project` and invokes `protect_license_BY_death_of_father_...()`, then conditionally unpacks the password-protected `b1n.zip`, while the payload files (`bin/H2Rapid.js`, `bin/H2Ryuk.js`, `bin/MReset.js`) are heavily obfuscated and contain anti-debugging traps. The scanned code also shows credential-theft/exfil behavior via `http://ip-api.com/json/8`, `https://t.me/anonchatQaxoh_bot`, and suspicious domains like `geo.org` and `indos4c.ru`, consistent with an attacker model of booter operators and covert telemetry/exfil. Metadata reinforces compromise-style distribution: a brand-new npm account (`acchengx`) with a single package and a malicious advisory match (`MAL-2026-14241`) corroborate the static findings. ENTRY bin/dxr.js (bin: bin/dxr.js) LOOT - Browser Data Theft in bin/H2Ryuk.js: "Chrome/131.0.0.0 Safari/537.36`,[/*Forbidden*/synco_ᅟᅠᅠᅠᅟᅠᅟᅠᅠᅠᅠᅠᅟᅠᅠ(0x2cd)]:`Moz..." DESTINATION - 2 exfil (reconstructed, custom-c2) (values recorded in verified_iocs) EXFIL - Suspicious Domain in bin/dxr.js: "https://203.0.113.10" - DNS Lookup in bin/webCheck.js: "dns.reverse(" OBFUSCATION - Decoded Unicode Escape Content in bin/MReset.js (x206) - Decoded Unicode Escape Content in bin/floodTls.js (x112) - Decoded Hex Escape Content in bin/killSSH.js (x81) - Decoded Hex Escape Content in bin/kqH2.js (x200) - Decoded Unicode Escape Content in bin/udpGod.js (x95) - Decoded Hex Escape Content in bin/xh2.js (x178) - Obfuscation: function to array replacements in bin/floodTls.js - Obfuscation: function to array replacements in bin/httpRaw.js (+59 more) ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in bin/H2Rapid.js: "http://ip-api.com/json/8" - Shell Command Execution in bin/H2Ryuk.js: "require('child_process')" - Silent Process Execution in bin/dxr.js: "stdio: "ignore"" - Very New NPM Publisher Account PAYLOAD FILES bin/H2Ryuk.js (+ bin/MReset.js, bin/kqH2.js)