MAL-2026-19143

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mock-data-sdk/MAL-2026-19143.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-19143
Published
2026-11-11T21:02:24Z
Modified
2026-11-11T21:15:16Z
Summary
Malicious code in mock-data-sdk (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f6f3367976e89b052e26e44ddc41d0352391f24336e41a8d41687a0d4c7010e0)

The package presents itself as a mock-data generator but hides a base64-encoded JavaScript payload across the mark fields of data/products_.js. The library entrypoint (index.js) concatenates those fields, decodes the result with Buffer.from(..., 'base64').toString('utf-8'), and executes it via the Function() constructor with Buffer, require, and process passed in as arguments. The identifiers 'Buffer', 'require', 'process', and 'new Function' are reconstructed at runtime from an XOR-obfuscated table keyed by a derived 4-byte seed, which conceals the eval sink from string-based scanners. The exported getTransactions() API triggers this execution on every call. The decoded payload loads python-shell and https, writes a Python script to /tmp/targets, and recursively walks the filesystem (pathlib.Path(root).rglob('')) for file names containing 'password', 'wallet', 'seed', 'privatekey', or '.env'. The advertised purpose (mock data) has no legitimate need to enumerate credential-, wallet-, and dotenv-shaped files on the installer's host or to run arbitrary code reconstructed from pseudo-data files.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022607",
            "import_time": "2026-11-11T21:05:23.50413818Z",
            "modified_time": "2026-11-11T21:02:24Z",
            "sha256": "f6f3367976e89b052e26e44ddc41d0352391f24336e41a8d41687a0d4c7010e0",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / mock-data-sdk

Package

Name
mock-data-sdk
View open source insights on deps.dev
Purl
pkg:npm/mock-data-sdk

Affected ranges

Affected versions

1.*
1.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "bcd159fca68ccb2d4b920cef97c36e3dfdfc417c594c7716ccbd59ad7915454b",
            "tlsh": "c1d100ac3bfc2028881bb26826db4449652dd0571e9a7ce87f4cc2417f2d17cd2f6b58"
        },
        {
            "path": "data/products_1.js",
            "sha256": "98a6ac1cc9d8420b07c2f269846f97d22c606026b3dca05a04518c3029df16b0",
            "tlsh": "54522e79cb780c9761091ca05af6094a7290475b0fea3e467f4dd54c8f9cc5f84ba62f"
        }
    ],
    "package_integrity": [
        {
            "filename": "mock-data-sdk-1.0.1.tgz",
            "hashes": {
                "sha1": "343aa32b625dbdb9de897afe891dde4ba61e8e89",
                "sha512_sri": "sha512-gWOcc8igVHl+OKsWDVpnIybv1WXhcwHgSgp0wcdr6JrBNASYSWoS2omuDO8S01Od3LWvAhtQ3EzQpxX8m1pFAg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mock-data-sdk/MAL-2026-19143.json"