Malicious npm package mock-transactions-sdk — full system compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-10-28
GitHub's malware advisory database published GHSA-357r-x5jp-3p8f flagging the npm package mock-transactions-sdk as malware (CWE-506, embedded malicious code). All versions (= 0) are affected and no patched version exists, so any installation is considered a compromise. The advisory states that any computer with the package installed or running should be treated as fully compromised, with full control potentially handed to an outside entity, enabling theft of secrets and keys and persistence beyond simple package removal. The package sees roughly 631 downloads per month. There is no fix; remediation is removal plus credential rotation and system rebuild.
What to do
- Remove mock-transactions-sdk from all systems and dependencies immediately
- Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer
- Rebuild/reimage affected machines; do not assume removal of the package removes the malware
- Audit dependency lockfiles and CI caches for the package and block it in registries/proxies
- Review logs for signs of exfiltration or attacker access
Sources
All live incidents on Threat Watch
