xxdxax (npm) · Malicious Code
Affects xxdxaxSource GCVE Database
Malicious package : remove xxdxax and rotate any secrets on hosts that installed it.
Data as of 7 Aug 2026, 07:42 UTC
Malicious package
Published to npm · OSV MAL-2026-13469
What to do
Remove xxdxax from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmxxdxax | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'xxdxax' versions 1.0.0 and 1.0.1 contains obfuscated malicious code designed to execute only in a browser environment when loaded on a specific WordPress site (noviembrenacional.com). The code exfiltrates page HTML and authenticated session data to a hardcoded external endpoint, then abuses the victim's WordPress session to delete other users' accounts or hijack the target account by changing its email and triggering a password reset. The payload is concealed using unicode escapes and string reversal techniques. This package is not a general-purpose library but a targeted offensive tool for account takeover on a specific WordPress site. Installing the package does not trigger the payload in Node.js environments, as it relies on browser APIs and site-specific conditions.