MAL-2026-13468

    Dashboard / Malicious Package / MAL-2026-13468

    MAL-2026-13468

    Published: 6 Aug 2026Last Modified: 6 Aug 2026

    Summary: Malicious code in xdaxx (npm)

    Details: Source: amazon-inspector (a7cd212c80bcca22443f4498afeadb70b93268b5904daa521b83242513d478bd) The tarball contains a working browser-side account-takeover payload gated to run on noviembrenacional.com. When loaded in a logged-in victim's browser, it uses the victim's authenticated session to delete other users' accounts via WordPress/BuddyPress `/members/<user>/settings/delete-account/` endpoints and, if the victim is the `noviembrenacional` administrator, changes the account email to `[email protected]` and triggers a password reset — completing a full account takeover. Execution progress is beaconed to a canarytokens.com URL controlled by the payload author. The same exploit is shipped in two forms: `original.js` in cleartext and `i.js` as a unicode-escape/hex-obfuscated copy (identifiers like `_0xd243bf`, strings built via `\u00XX` escapes and reversed-string tricks). The package has no lifecycle hooks and the declared main entry is missing, so installing or importing the package does not itself run the payload against the installer's machine; the npm registry is being used as hosting/distribution for a targeted attack tool against a specific third-party site.

    References: https://www.npmjs.com/package/xdaxx/v/1.0.1

    Affected packages

    Package

    Name: xdaxx

    Purl: pkg:npm/xdaxx

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1
    MAL-2026-13468 | CVE-DB