mock-data-sdk (npm) 1.0.1 — malicious package executes hidden payload that hunts credential, wallet and .env files
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
The npm package mock-data-sdk, advertised as a mock-data generator, contains malicious code in version 1.0.1. Its entrypoint concatenates base64-encoded payloads hidden in the mark fields of data/products.js files, decodes them and executes via the Function() constructor, with identifiers like 'Buffer', 'require' and 'process' reconstructed at runtime from an XOR-obfuscated table to evade string-based scanners. The exported getTransactions() API triggers execution on every call. The decoded payload loads python-shell and https, writes a Python script to /tmp/targets, and recursively walks the filesystem for files named with 'password', 'wallet', 'seed', 'privatekey' or '.env', enabling credential and wallet theft. Flagged by Amazon Inspector and credited to OpenSSF's malicious-packages database. No patched version exists; the package must be removed.
What to do
- Remove mock-data-sdk from all projects and lockfiles immediately; do not use any version
- Rotate any credentials, API keys, wallet seeds or private keys stored on machines where the package was installed or getTransactions() was called
- Audit hosts for /tmp/targets and signs of filesystem enumeration or exfiltration over https
- Check CI/CD pipelines and dependency caches for the package and rebuild from clean environments
- Block the package name in internal registries and add it to dependency-scanning denylists
Sources
All live incidents on Threat Watch
