I checked the code of MegaMedusa and it looks sus to me. the node.js program is pretty obfuscated, not what I would like my open source software to be.
Since obfuscated js is a bitch to reverse-engineer for me, I can only make some quick remarks:
all things node.js are comparatively slow. for a layer 7 attack, javascript is not necessarily required. it boast things like ddos guard bypass and captcha bypass. simple ddos guard bypass, maybe, but captcha bypass? i do not see that happening realistically in 300-something lines of js code.
have you tested it thorougly (in a vm, in case its malware, duh)?