MAL-2026-14058 Malicious code in adxaa (npm)

The tarball stages an obfuscated JavaScript payload (i.js, with an un-obfuscated copy in original.js) that gates on window.location.href containing 'noviembrenacional.com' and then, using the victim's authenticated session (fetch with credentials:'include'), exfiltrates the current page HTML and username to a canarytokens.com submit endpoint, POSTs to /members/<user>/settings/delete-account/, and for a specific target user overwrites the account email to a hardcoded attacker ProtonMail address ([email protected]) via /my-account/editar-cuenta/ before triggering /wp-login.php?action=lostpassword to seize the account through password reset. The package's declared main (a.js) is absent from the tarball and no lifecycle scripts are declared, so this code does not auto-execute on npm install or require against an arbitrary installer; the payload is staged on the registry for delivery to browsers on the targeted WordPress site.