MAL-2026-11400

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/thedata/MAL-2026-11400.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11400
Aliases
  • GHSA-g67p-r2r2-224w
Published
2026-07-30T18:14:47Z
Modified
2026-08-05T06:36:35.702023977Z
Summary
Malicious code in thedata (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5e05613178114f2f3d9171f429a5b6aba8e1a525e07db22d150be81c02d6f595)

The package's main entry (index.js) re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply readFileSync's apps/docs/app/rsa.db and apps/docs/app/des.db as UTF-8 strings. Both.db files are base64-encoded OpenSSL 'Salted__' ciphertext. The package contains no code that decrypts, uses, or otherwise interacts with these blobs, and no documented API beyond exposing them. The package name resembles 'Theta Data' per the README but the shipped functionality does not implement any such client. Installing or importing thedata by itself performs no network activity, no filesystem access outside its own directory, no credential reads, and no code execution — the encrypted payloads are inert unless a separate consumer supplies the decryption key. The shape (a nearly-empty library whose only purpose is to serve opaque encrypted content to another party) is unusual for a legitimate library but does not by itself establish installer harm from this package alone.

Source: ghsa-malware (1a92a93e170cd900d44df29d9f451294b09f9138882739c1f1874a2e09c4f3a1)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "ghsa-malware",
            "modified_time": "2026-07-30T18:14:47Z",
            "ranges": [
                {
                    "type": "SEMVER",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ],
            "id": "GHSA-g67p-r2r2-224w",
            "sha256": "1a92a93e170cd900d44df29d9f451294b09f9138882739c1f1874a2e09c4f3a1",
            "import_time": "2026-07-31T01:10:09.642629663Z"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T05:29:57Z",
            "sha256": "aae0c3c189b872f37e292a919ed0022d384444a9d0f1e3b189496a425be77820",
            "id": "IN-MAL-2026-013072",
            "versions": [
                "1.0.6"
            ],
            "import_time": "2026-08-05T06:00:37.92485198Z"
        },
        {
            "import_time": "2026-08-05T06:00:23.550576716Z",
            "sha256": "c2b1597df64509bb2d8654181774988d6418754a4b89136128a88e920dbe03cd",
            "modified_time": "2026-08-05T05:12:31Z",
            "id": "IN-MAL-2026-012951",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T05:48:48Z",
            "sha256": "c73199dfbb60faf8de791651f57e0d7a78f2e2a51bbc548149ee731a6c982b0f",
            "id": "IN-MAL-2026-013203",
            "versions": [
                "1.0.11"
            ],
            "import_time": "2026-08-05T06:00:53.544393513Z"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T05:29:39Z",
            "sha256": "c73c62bb66adb011a3b36da17613ef9eba35d7dbe80470e8f35a7ee01d6e7927",
            "id": "IN-MAL-2026-013070",
            "versions": [
                "1.0.10"
            ],
            "import_time": "2026-08-05T06:00:37.675306352Z"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T05:27:04Z",
            "sha256": "05eece33a493bb68a3f8f2eaacf808ca433da53f7cc016e65e156585759f22da",
            "id": "IN-MAL-2026-013052",
            "versions": [
                "1.0.8"
            ],
            "import_time": "2026-08-05T06:00:35.648651193Z"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T05:12:55Z",
            "sha256": "35f7865aa2bb56b028d9d8b7d013b02ed6372275872e0d461f7ed0233febd851",
            "id": "IN-MAL-2026-012954",
            "versions": [
                "1.0.13"
            ],
            "import_time": "2026-08-05T06:00:23.945931237Z"
        },
        {
            "import_time": "2026-08-05T06:00:38.860052272Z",
            "sha256": "36dacc79a0f1595ce79187b8c0d16ec580db9e540fa11f7dc20e91286ab57981",
            "modified_time": "2026-08-05T05:31:04Z",
            "id": "IN-MAL-2026-013080",
            "versions": [
                "1.0.12"
            ],
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T05:27:11Z",
            "sha256": "4b9a5ef39aba0be4474874f9558e89c48d9aa7db2703fb681bfd993df9758847",
            "id": "IN-MAL-2026-013053",
            "versions": [
                "1.0.2"
            ],
            "import_time": "2026-08-05T06:00:35.764345452Z"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T05:26:13Z",
            "sha256": "5e05613178114f2f3d9171f429a5b6aba8e1a525e07db22d150be81c02d6f595",
            "id": "IN-MAL-2026-013046",
            "versions": [
                "1.0.4"
            ],
            "import_time": "2026-08-05T06:00:34.998328997Z"
        },
        {
            "import_time": "2026-08-05T06:00:35.318156775Z",
            "sha256": "6dc0e01861d3922b8469be4e5fadced1ba790bc21bcfa71e61c8c2848ed5b65a",
            "modified_time": "2026-08-05T05:26:40Z",
            "id": "IN-MAL-2026-013049",
            "versions": [
                "1.0.7"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T06:00:38.039515441Z",
            "modified_time": "2026-08-05T05:30:06Z",
            "sha256": "b763a2551f06cea0d1880b4647f43a163cbe06022f99ec605d08ea06aee08ff7",
            "id": "IN-MAL-2026-013073",
            "versions": [
                "1.0.5"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T06:00:54.928404292Z",
            "sha256": "e994b09ae3cc5433aefa34073e053f586da7af3af29cc86de31ad0eb405ec06d",
            "modified_time": "2026-08-05T05:50:54Z",
            "id": "IN-MAL-2026-013216",
            "versions": [
                "1.0.1"
            ],
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T05:26:04Z",
            "sha256": "3a4045af401fe43c9e626fb3b6e1bea1cf90de035febab31fbffc29836963446",
            "id": "IN-MAL-2026-013045",
            "versions": [
                "1.0.9"
            ],
            "import_time": "2026-08-05T06:00:34.880296293Z"
        },
        {
            "import_time": "2026-08-05T06:00:35.521640361Z",
            "modified_time": "2026-08-05T05:26:56Z",
            "sha256": "895edaf6e2dc28fc713f8dfba49d8fb06fe6ce5f46166026652368a5d91a4890",
            "id": "IN-MAL-2026-013051",
            "versions": [
                "1.0.3"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / thedata

Package

Name
thedata
View open source insights on deps.dev
Purl
pkg:npm/thedata

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.0.10
1.0.11
1.0.12
1.0.13

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "apps/docs/app/theta.js",
            "sha256": "248e883a193f21ac7d1eb48fa7541513fbc381620d03957e7e70c8fa359d0984",
            "tlsh": "cfd022c20c0f03888ee15b98950e60620bb300083b80d6a1f47d8f30302b488f55a29c"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/thedata/MAL-2026-11400.json"