mock-data-sdk (npm) · Malicious Code
Affects mock-data-sdkSource GCVE Database
Malicious package : remove mock-data-sdk and rotate any secrets on hosts that installed it.
Data as of 11 Nov 2026, 22:20 UTC
Malicious package
Published to npm · OSV MAL-2026-19143
What to do
Remove mock-data-sdk from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmmock-data-sdk | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f6f3367976e89b052e26e44ddc41d0352391f24336e41a8d41687a0d4c7010e0) The package presents itself as a mock-data generator but hides a base64-encoded JavaScript payload across the `mark` fields of data/products_*.js. The library entrypoint (index.js) concatenates those fields, decodes the result with Buffer.from(..., 'base64').toString('utf-8'), and executes it via the Function() constructor with Buffer, require, and process passed in as arguments. The identifiers 'Buffer', 'require', 'process', and 'new Function' are reconstructed at runtime from an XOR-obfuscated table keyed by a derived 4-byte seed, which conceals the eval sink from string-based scanners. The exported getTransactions() API triggers this execution on every call. The decoded payload loads python-shell and https, writes a Python script to /tmp/targets, and recursively walks the filesystem (pathlib.Path(root).rglob('*')) for file names containing 'password', 'wallet', 'seed', 'privatekey', or '.env'. The advertised purpose (mock data) has no legitimate need to enumerate credential-, wallet-, and dotenv-shaped files on the installer's host or to run arbitrary code reconstructed from pseudo-data files.