The npm package 'xxdxax' versions 1.0.0 and 1.0.1 contains obfuscated malicious code designed to execute only in a browser environment when loaded on a specific WordPress site (noviembrenacional.com). The code exfiltrates page HTML and authenticated session data to a hardcoded external endpoint, then abuses the victim's WordPress session to delete other users' accounts or hijack the target account by changing its email and triggering a password reset. The payload is concealed using unicode escapes and string reversal techniques. This package is not a general-purpose library but a targeted offensive tool for account takeover on a specific WordPress site. Installing the package does not trigger the payload in Node.js environments, as it relies on browser APIs and site-specific conditions.