Malicious npm package mock-datas-lib — full host compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
GitHub's advisory database published a malware advisory for the npm package mock-datas-lib on 2026-11-04 (GHSA-33jq-j4x3-75pc). Every version (= 0) is classified as embedded malicious code (CWE-506) with no patched version available. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, implying the malware grants outside attackers full control of the host, including access to secrets and keys. There is no known source code repository and no fix; removal of the package does not guarantee removal of the malicious software. Any developer or CI environment that installed the package is affected.
What to do
- Rotate all secrets, keys, tokens and credentials stored on any machine where mock-datas-lib was installed, using a clean machine
- Remove the package and rebuild/reimage affected machines; do not assume removal fully cleans the host
- Audit npm lockfiles and CI caches for mock-datas-lib and block the package name in dependency firewalls
- Review access logs and network traffic from affected hosts for signs of attacker activity
- Notify security teams of potential credential exposure from developer workstations and CI runners
Sources
All live incidents on Threat Watch
