{"answers":{"affected":"1 open source package ship an affected version, including adxaa.","exploited":"There is no known exploitation of MAL-2026-14058 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-14058 is a malicious package in adxaa, published on 15 Aug 2026."},"fix_prompt":"MAL-2026-14058 is a malicious package: adxaa (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-14058/ (Markdown: https://insights.sbomify.com/MAL-2026-14058/index.md)","id":"MAL-2026-14058","markdown":"https://insights.sbomify.com/MAL-2026-14058/index.md","name":"MAL-2026-14058","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The tarball stages an obfuscated JavaScript payload (i.js, with an un-obfuscated copy in original.js) that gates on window.location.href containing 'noviembrenacional.com' and then, using the victim's authenticated session (fetch with credentials:'include'), exfiltrates the current page HTML and username to a canarytokens.com submit endpoint, POSTs to /members/\u003cuser\u003e/settings/delete-account/, and for a specific target user overwrites the account email to a hardcoded attacker ProtonMail address (nyxalor_25@proton.me) via /my-account/editar-cuenta/ before triggering /wp-login.php?action=lostpassword to seize the account through password reset. The package's declared main (a.js) is absent from the tarball and no lifecycle scripts are declared, so this code does not auto-execute on npm install or require against an arbitrary installer; the payload is staged on the registry for delivery to browsers on the targeted WordPress site.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in adxaa (npm)","id":"MAL-2026-14058","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"adxaa","purl":"pkg:npm/adxaa","source":"MAL-2026-14058"}],"products":null,"published":"2026-08-15","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-14058/"}