xdaxx (npm) · Malicious Code
Affects xdaxxSource GCVE Database
Malicious package : remove xdaxx and rotate any secrets on hosts that installed it.
Data as of 7 Aug 2026, 06:12 UTC
Malicious package
Published to npm · OSV MAL-2026-13468
What to do
Remove xdaxx from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmxdaxx | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'xdaxx' version 1.0.1 contains malicious code designed to perform a targeted browser-side account takeover attack against the website noviembrenacional.com. When a logged-in victim visits the site with the payload loaded, it abuses the victim's authenticated session to delete other users' accounts via WordPress/BuddyPress endpoints. If the victim is the administrator, the payload changes the administrator's email and triggers a password reset, completing full account takeover. The malicious code is delivered in two forms: a cleartext script and an obfuscated script. The package itself does not execute the payload upon installation or import, indicating it is used as a hosting/distribution mechanism for this targeted attack tool.