Malicious code in adxaa (npm)

The npm package adxaa was published with malicious code embedded in obfuscated JavaScript files (i.js and original.js). The payload is geofenced to activate only when a user's browser accesses the target domain noviembrenacional.com.\n\nWhen triggered, the malicious code uses the victim's authenticated session to exfiltrate the current page HTML and username to a canarytokens.com endpoint. It then performs account takeover by POSTing to WordPress endpoints to delete the account and overwrite the email address to a hardcoded attacker-controlled ProtonMail address (nyxalor_25@proton.me).\n\nThe package's declared main entry point (a.js) was absent from the tarball and no lifecycle scripts were declared, meaning the payload does not auto-execute on npm install or require. Instead, the code was staged on the registry for delivery to browsers visiting the targeted WordPress site.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.