The npm package 'xxdxa' contains a malicious main file that executes obfuscated code immediately upon loading. In browser contexts on the domain noviembrenacional.com, it exfiltrates the full page HTML to an attacker-controlled server and attempts to perform account takeover attacks against logged-in WordPress users by changing their account email and triggering password resets. For a specific admin user, it attempts account deletion. In Node.js environments, it leaks installation details to the attacker. The malicious behavior is heavily obfuscated to conceal attacker infrastructure and targets.