Source: amazon-inspector (52685b4948dce286ad5cf0bbf4d0a7c8cf6b6a87ebfc2f70e20dbea685ab62c9)
The tarball stages an obfuscated JavaScript payload (i.js, with an un-obfuscated copy in original.js) that gates on window.location.href containing 'noviembrenacional.com' and then, using the victim's authenticated session (fetch with credentials:'include'), exfiltrates the current page HTML and username to a canarytokens.com submit endpoint, POSTs to /members//settings/delete-account/, and for a specific target user overwrites the account email to a hardcoded attacker ProtonMail address (nyxalor_25@proton.me) via /my-account/editar-cuenta/ before triggering /wp-login.php?action=lostpassword to seize the account through password reset. The package's declared main (a.js) is absent from the tarball and no lifecycle scripts are declared, so this code does not auto-execute on npm install or require against an arbitrary installer; the payload is staged on the registry for delivery to browsers on the targeted WordPress site.
Credit: OpenSSF (source)
References
Source: amazon-inspector (52685b4948dce286ad5cf0bbf4d0a7c8cf6b6a87ebfc2f70e20dbea685ab62c9)
The tarball stages an obfuscated JavaScript payload (i.js, with an un-obfuscated copy in original.js) that gates on window.location.href containing 'noviembrenacional.com' and then, using the victim's authenticated session (fetch with credentials:'include'), exfiltrates the current page HTML and username to a canarytokens.com submit endpoint, POSTs to /members//settings/delete-account/, and for a specific target user overwrites the account email to a hardcoded attacker ProtonMail address (nyxalor_25@proton.me) via /my-account/editar-cuenta/ before triggering /wp-login.php?action=lostpassword to seize the account through password reset. The package's declared main (a.js) is absent from the tarball and no lifecycle scripts are declared, so this code does not auto-execute on npm install or require against an arbitrary installer; the payload is staged on the registry for delivery to browsers on the targeted WordPress site.
Credit: OpenSSF (source)
References