Malicious code in xdaxx (npm)
The npm package xdaxx contains malicious JavaScript code designed to perform account takeover attacks against noviembrenacional.com. The payload deletes user accounts and can hijack administrator accounts by changing email and triggering password resets, with execution progress beaconed to attacker-controlled infrastructure.
- Disclosed
- Last updated
- Blast radius
- Targeted attack against noviembrenacional.com; potential for account deletion and takeover of administrator accounts on that site.
- Ecosystems
- Attack vectors
- Affected entities
- xdaxxnpm package containing malicious browser-side payload
The npm package xdaxx was found to contain malicious JavaScript code targeting the WordPress/BuddyPress site noviembrenacional.com. The payload is gated to execute only when loaded in a logged-in victim's browser on that specific domain.\n\nWhen executed, the malicious code leverages the victim's authenticated session to delete other user accounts via WordPress/BuddyPress endpoints (/members/*/settings/delete-account/). If the victim is the site administrator, the payload additionally changes the account email to nyxalor_25@proton.me and triggers a password reset, completing a full account takeover.\n\nThe exploit code exists in two forms within the package: original.js in cleartext and i.js as an obfuscated copy using unicode-escape sequences and reversed-string tricks. The package contains no lifecycle hooks and its declared main entry is missing, meaning installation does not automatically execute the payload on the installer's machine. The npm registry was being used as a distribution mechanism for a targeted attack tool against a specific third-party site.\n\nExecution progress is beaconed to a canarytokens.com URL controlled by the attacker. The incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- xdaxx
- Domains
- noviembrenacional.com
- canarytokens.com
- nyxalor_25@proton.me
Remediation
- Remove the xdaxx package from any npm installations or dependencies
- Audit npm package.json files and lock files for any references to xdaxx
- If noviembrenacional.com users were exposed, audit account activity for unauthorized deletions or email/password changes
- Review browser history and network logs for any requests to canarytokens.com or related attacker infrastructure
- Implement npm package scanning and verification in CI/CD pipelines to detect malicious packages before installation
Sources
- GitHub Advisory GHSA-qhqw-3g9p-hj8v · GitHub Advisory Database
Cite this entry
"Malicious code in xdaxx (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-xdaxx-npm-192o6f
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @syncraft-labs/vue (npm)
The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.
npmCompromised package - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - activecritical
Malware in @sdgdfgdfhhhfd/multiviewr
Malware discovered in the npm package @sdgdfgdfhhhfd/multiviewr. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malicious code in 3-buildsight-web (npm)
The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.
npmCompromised package