MAL-2026-14058
Malicious code in adxaa (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (52685b4948dce286ad5cf0bbf4d0a7c8cf6b6a87ebfc2f70e20dbea685ab62c9) The tarball stages an obfuscated JavaScript payload (i.js, with an un-obfuscated copy in original.js) that gates on window.location.href containing 'noviembrenacional.com' and then, using the victim's authenticated session (fetch with credentials:'include'), exfiltrates the current page HTML and username to a canarytokens.com submit endpoint, POSTs to /members/<user>/settings/delete-account/, and for a specific target user overwrites the account email to a hardcoded attacker ProtonMail address (nyxalor_25@proton.me) via /my-account/editar-cuenta/ before triggering /wp-login.php?action=lostpassword to seize the account through password reset. The package's declared main (a.js) is absent from the tarball and no lifecycle scripts are declared, so this code does not auto-execute on npm install or require against an arbitrary installer; the payload is staged on the registry for delivery to browsers on the targeted WordPress site.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for adxaa (npm). Pin to a known-safe version or switch to an alternative.