MAL-2026-14058

    Dashboard / Malicious Package / MAL-2026-14058

    MAL-2026-14058

    Published: 15 Aug 2026Last Modified: 15 Aug 2026

    Summary: Malicious code in adxaa (npm)

    Details: Source: amazon-inspector (52685b4948dce286ad5cf0bbf4d0a7c8cf6b6a87ebfc2f70e20dbea685ab62c9) The tarball stages an obfuscated JavaScript payload (i.js, with an un-obfuscated copy in original.js) that gates on window.location.href containing 'noviembrenacional.com' and then, using the victim's authenticated session (fetch with credentials:'include'), exfiltrates the current page HTML and username to a canarytokens.com submit endpoint, POSTs to /members/<user>/settings/delete-account/, and for a specific target user overwrites the account email to a hardcoded attacker ProtonMail address ([email protected]) via /my-account/editar-cuenta/ before triggering /wp-login.php?action=lostpassword to seize the account through password reset. The package's declared main (a.js) is absent from the tarball and no lifecycle scripts are declared, so this code does not auto-execute on npm install or require against an arbitrary installer; the payload is staged on the registry for delivery to browsers on the targeted WordPress site.

    References: https://www.npmjs.com/package/adxaa/v/1.0.0

    Affected packages

    Package

    Name: adxaa

    Purl: pkg:npm/adxaa

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-14058 | CVE-DB