The npm package 'xdaxx' version 1.0.1 contains malicious code designed to perform a targeted browser-side account takeover attack against the website noviembrenacional.com. When a logged-in victim visits the site with the payload loaded, it abuses the victim's authenticated session to delete other users' accounts via WordPress/BuddyPress endpoints. If the victim is the administrator, the payload changes the administrator's email and triggers a password reset, completing full account takeover. The malicious code is delivered in two forms: a cleartext script and an obfuscated script. The package itself does not execute the payload upon installation or import, indicating it is used as a hosting/distribution mechanism for this targeted attack tool.