MAL-2026-13468

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/xdaxx/MAL-2026-13468.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13468
Published
2026-08-06T19:28:26Z
Modified
2026-08-06T23:50:28.362977823Z
Summary
Malicious code in xdaxx (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a7cd212c80bcca22443f4498afeadb70b93268b5904daa521b83242513d478bd)

The tarball contains a working browser-side account-takeover payload gated to run on noviembrenacional.com. When loaded in a logged-in victim's browser, it uses the victim's authenticated session to delete other users' accounts via WordPress/BuddyPress /members/<user>/settings/delete-account/ endpoints and, if the victim is the noviembrenacional administrator, changes the account email to nyxalor_25@proton.me and triggers a password reset — completing a full account takeover. Execution progress is beaconed to a canarytokens.com URL controlled by the payload author. The same exploit is shipped in two forms: original.js in cleartext and i.js as a unicode-escape/hex-obfuscated copy (identifiers like _0xd243bf, strings built via \u00XX escapes and reversed-string tricks). The package has no lifecycle hooks and the declared main entry is missing, so installing or importing the package does not itself run the payload against the installer's machine; the npm registry is being used as hosting/distribution for a targeted attack tool against a specific third-party site.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-016769",
            "import_time": "2026-08-06T23:25:08.363094992Z",
            "sha256": "a7cd212c80bcca22443f4498afeadb70b93268b5904daa521b83242513d478bd",
            "modified_time": "2026-08-06T19:28:26Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / xdaxx

Package

Name
xdaxx
View open source insights on deps.dev
Purl
pkg:npm/xdaxx

Affected ranges

Affected versions

1.*
1.0.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "original.js",
            "tlsh": "eba1116520f706615c7361de63fba60aa418611b38a3d5c83fec5b081f8ce559c32bec",
            "sha256": "321f05d920a0a5cc680d5dcbcbfc524397c8587bb35fb28e93c42fc22a26de8b"
        },
        {
            "path": "i.js",
            "tlsh": "4342d4a64377aebecc709a048d35be1adcf889b65fe7d02a65073884cc797f04791258",
            "sha256": "d12fe0144ad08f27bfa5a43fc821fbb6ca66ad19a6520b6f66b4d33d634bd5db"
        }
    ],
    "package_integrity": [
        {
            "filename": "xdaxx-1.0.1.tgz",
            "hashes": {
                "sha1": "c2865e121a8583ffbf90c892aa460f9a45d969c3",
                "sha512_sri": "sha512-KjiN5iF4WfaLYEbKtBNDKxIuaQZTpLj/FdjmmyReWvQQFZq7yYR33OQ416ANFuMTHvU77AD5portCvfpSiXfsQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/xdaxx/MAL-2026-13468.json"