Malicious code in xxdxax (npm)

Source: amazon-inspector 8922341a391ea133f4e6b95d55da2a7ee404c99a9f88f75bdc2698d3f03cc97c The package's main file i.js is an obfuscated browser-side script — its de-obfuscated form is shipped alongside as original.js — that gates execution on window.location.href containing 'noviembrenacional.com...