ddaxx@1.0.0

Analysis

Package ddaxx@1.0.0 ships an obfuscated browser-side script (package/a.js) that targets the WordPress site noviembreacional[.]com. When loaded on that site, the script: (1) beacons the page HTML to a canarytoken at canarytokens[.]com/tags/feedback/kiwhjd8z03ya08mh9wc04hn/submit.asp?x; (2) reads the logged-in BuddyPress username; (3) if the user is not the site admin, it fetches the user's account deletion page, extracts the CSRF nonce, and POSTs to delete that user's account; (4) if the user IS the site admin, it fetches the account settings page, extracts the nonce, and POSTs to change the account email to nyalorx@25_proton.me, then triggers a WordPress password reset for that email. The script uses fetch() with credentials: 'include' to perform authenticated cross-site requests against the WordPress REST endpoints.