The 'xdaxx' npm package version 1.0.1 contains a malicious payload that targets the website noviembrenacional.com. The payload executes in the browser of logged-in users, leveraging their authenticated sessions to delete other users' accounts through WordPress/BuddyPress API endpoints. For the administrator account, it changes the email address to a controlled ProtonMail address and triggers a password reset, effectively taking over the admin account. The payload signals its execution progress to a canarytokens.com URL controlled by the attacker. The malicious code is present in two forms: 'original.js' in cleartext and 'i.js' obfuscated with unicode escapes and string reversal. The package lacks lifecycle hooks and a main entry point, so installing or importing it does not trigger the payload on the installer's machine. This indicates the npm registry is being abused to distribute a targeted attack tool rather than a general-purpose malicious package.

The impact is a targeted account takeover attack on the website noviembrenacional.com. Authenticated users who load the malicious payload in their browsers can have other users' accounts deleted. If the victim is the site administrator, the attacker gains full control by changing the admin email and resetting the password. This leads to complete compromise of the administrator account and potential loss of user accounts on the targeted site. There is no indication of widespread exploitation beyond this specific target.

No official patch or remediation is indicated. Since the package does not execute malicious code on installation or import, avoid using or installing the 'xdaxx' package version 1.0.1. Site administrators of noviembrenacional.com should verify account integrity and reset credentials if compromised. Monitor for unauthorized account deletions and changes. Consider blocking or removing this package from internal repositories and audit dependencies for similar malicious packages. Patch status is not yet confirmed — check the npm advisory or vendor sources for updates.