The 'xxdxax' npm package (versions 1.0.0 and 1.0.1) contains a malicious browser-side script that activates only when loaded on the 'noviembrenacional.com' WordPress site. The obfuscated main script exfiltrates page content and authenticated session information to a hardcoded external URL. It then leverages the victim's authenticated WordPress session to perform unauthorized actions such as deleting other users' accounts or hijacking the current account by changing the email address to '[email protected]' and triggering a password reset. The payload uses obfuscation techniques including unicode escapes and reversed strings to hide critical strings and URLs. The package is designed specifically for targeted CSRF and account takeover attacks on this WordPress site and does not execute its payload in Node.js environments due to reliance on browser-only APIs and URL gating.

Successful execution of this malicious package on the targeted WordPress site can lead to exfiltration of sensitive session data and page content, unauthorized deletion of user accounts, and account takeover via email change and password reset. This compromises user accounts and site integrity on the targeted domain. The attack is highly targeted and does not affect general npm package users unless the package is loaded in a browser context on the specified site.

No official patch or remediation is currently documented. Since the package is malicious by design and targeted, the primary mitigation is to avoid installing or using the 'xxdxax' npm package versions 1.0.0 and 1.0.1. Site administrators of 'noviembrenacional.com' should monitor for unauthorized scripts and consider implementing CSRF protections and session security measures. Users should verify the integrity of npm packages before installation. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.