xxdxax@1.0.1

Analysis

Package xxdxax@1.0.1 contains a browser-side WordPress account takeover script targeting noviembrenacional[.]com. On execution in a browser context on that domain, the script beacons progress to canarytokens[.]com/articles/tags/images/j11lq4swuzvslc96qfi9pmsji/submit.aspx. For the admin user "noviembrenacional" it changes the account email to [account] and triggers a password reset via /wp-login.php?action=lostpassword. For any other logged-in user it deletes their account via /members/{username}/settings/delete-account/. The package has no lifecycle hooks and no Node.js runtime impact — it is a client-side exploit hosted on the npm registry.