xxdxa@1.0.5

Analysis

Package xxdxa@1.0.5 ships an obfuscated browser-side JavaScript payload (package/i.js) that targets the WordPress site noviembreaccional[.]com. When loaded in a browser on that domain, the script exfiltrates the full page HTML and the logged-in username to a canarytokens[.]com beacon (hxxps://canarytokens[.]com/images/terms/e63c36xvesfv8udb0yii1xztu/contact[.]php). If the logged-in user is not the site owner ("JuanCuates"), the script fetches the victim's account settings page, extracts the WordPress nonce, and POSTs to delete the victim's account. If the logged-in user IS the site owner, the script fetches the account edit page, extracts the nonce and profile fields, then POSTs to change the account email to [account] and triggers a password reset via wp-login.php?action=lostpassword — achieving full account takeover. Every step of the attack beacons status to the canarytoken URL.