{"id":"MAL-2026-19143","kind":"package","aliases":["MAL-2026-19143"],"related":[],"title":"Malicious code in mock-data-sdk (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f6f3367976e89b052e26e44ddc41d0352391f24336e41a8d41687a0d4c7010e0)\nThe package presents itself as a mock-data generator but hides a base64-encoded JavaScript payload across the `mark` fields of data/products_*.js. The library entrypoint (index.js) concatenates those fields, decodes the result with Buffer.from(..., 'base64').toString('utf-8'), and executes it via the Function() constructor with Buffer, require, and process passed in as arguments. The identifiers 'Buffer', 'require', 'process', and 'new Function' are reconstructed at runtime from an XOR-obfuscated table keyed by a derived 4-byte seed, which conceals the eval sink from string-based scanners. The exported getTransactions() API triggers this execution on every call. The decoded payload loads python-shell and https, writes a Python script to /tmp/targets, and recursively walks the filesystem (pathlib.Path(root).rglob('*')) for file names containing 'password', 'wallet', 'seed', 'privatekey', or '.env'. The advertised purpose (mock data) has no legitimate need to enumerate credential-, wallet-, and dotenv-shaped files on the installer's host or to run arbitrary code reconstructed from pseudo-data files.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mock-data-sdk","fixed":[],"affected":"= 1.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-11T21:02:24+00:00","first_seen_at":"2026-11-11T21:29:24+00:00","triaged_at":"2026-11-11T21:30:27+00:00","updated_at":"2026-11-11T21:31:13+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-19143':11A,14A '-2026':10A,13A '-8':75C '/tmp/targets':151C '4':114C 'across':53C 'advertis':171C 'amazon':32C 'amazon-inspector':31C 'api':130C 'arbitrari':196C 'argument':91C 'base':125C 'base64':49C,72C 'base64-encoded':48C 'buffer':84C,94C 'buffer.from':71C 'byte':115C 'call':136C 'code':2A,197C 'concaten':64C 'conceal':118C 'constructor':82C 'contain':163C 'credenti':181C 'data':6A,17A,43C,174C,202C 'data/products_':58C 'decod':67C,138C 'deriv':113C 'detail':23C 'dotenv':185C 'dotenv-shap':184C 'edit':26C 'encod':50C 'entrypoint':62C 'enumer':180C 'env':169C 'eval':120C 'everi':135C 'execut':77C,133C 'export':128C 'f6f3367976e89b052e26e44ddc41d0352391f24336e41a8d41687a0d4c7010e0':34C 'field':56C,66C 'file':161C,187C,203C 'filesystem':156C 'function':81C,99C 'generat':44C 'gettransact':129C 'hide':46C 'host':192C 'https':145C 'identifi':93C 'index.js':63C 'inspector':33C 'instal':190C 'javascript':51C 'js':59C 'key':110C 'legitim':177C 'librari':61C 'line':29C 'load':140C 'mal':9A,12A 'malici':1A,19B 'mark':55C 'mock':5A,16A,42C,173C 'mock-data':41C 'mock-data-sdk':4A,15A 'name':162C 'need':178C 'new':98C 'npm':8A 'obfusc':108C 'packag':20B,36C 'pass':88C 'password':164C 'pathlib.path':157C 'payload':52C,139C 'per':21C 'present':37C 'privatekey':167C 'process':87C,96C 'pseudo':201C 'pseudo-data':200C 'purpos':172C 'python':142C,148C 'python-shel':141C 'reconstruct':101C,198C 'recurs':153C 'requir':85C,95C 'result':69C 'rglob':159C 'root':158C 'run':195C 'runtim':103C 'scanner':126C 'script':149C 'sdk':7A,18A 'seed':116C,166C 'shape':186C 'shell':143C 'sink':121C 'sourc':22C,30C 'string':124C 'string-bas':123C 'tabl':109C 'tostr':73C 'trigger':131C 'utf':74C 'via':79C 'walk':154C 'wallet':165C,182C 'write':146C 'xor':107C 'xor-obfusc':106C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["mockdatasdk"],"ptokens":["data","mock","sdk"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"search_a":"'-19143':11A,14A '-2026':10A,13A 'code':2A 'data':6A,17A 'mal':9A,12A 'malici':1A 'mock':5A,16A 'mock-data-sdk':4A,15A 'npm':8A 'sdk':7A,18A","search_b":"'malici':19B 'packag':20B","search_c":"'-8':75C '/tmp/targets':151C '4':114C 'across':53C 'advertis':171C 'amazon':32C 'amazon-inspector':31C 'api':130C 'arbitrari':196C 'argument':91C 'base':125C 'base64':49C,72C 'base64-encoded':48C 'buffer':84C,94C 'buffer.from':71C 'byte':115C 'call':136C 'code':197C 'concaten':64C 'conceal':118C 'constructor':82C 'contain':163C 'credenti':181C 'data':43C,174C,202C 'data/products_':58C 'decod':67C,138C 'deriv':113C 'detail':23C 'dotenv':185C 'dotenv-shap':184C 'edit':26C 'encod':50C 'entrypoint':62C 'enumer':180C 'env':169C 'eval':120C 'everi':135C 'execut':77C,133C 'export':128C 'f6f3367976e89b052e26e44ddc41d0352391f24336e41a8d41687a0d4c7010e0':34C 'field':56C,66C 'file':161C,187C,203C 'filesystem':156C 'function':81C,99C 'generat':44C 'gettransact':129C 'hide':46C 'host':192C 'https':145C 'identifi':93C 'index.js':63C 'inspector':33C 'instal':190C 'javascript':51C 'js':59C 'key':110C 'legitim':177C 'librari':61C 'line':29C 'load':140C 'mark':55C 'mock':42C,173C 'mock-data':41C 'name':162C 'need':178C 'new':98C 'obfusc':108C 'packag':36C 'pass':88C 'password':164C 'pathlib.path':157C 'payload':52C,139C 'per':21C 'present':37C 'privatekey':167C 'process':87C,96C 'pseudo':201C 'pseudo-data':200C 'purpos':172C 'python':142C,148C 'python-shel':141C 'reconstruct':101C,198C 'recurs':153C 'requir':85C,95C 'result':69C 'rglob':159C 'root':158C 'run':195C 'runtim':103C 'scanner':126C 'script':149C 'seed':116C,166C 'shape':186C 'shell':143C 'sink':121C 'sourc':22C,30C 'string':124C 'string-bas':123C 'tabl':109C 'tostr':73C 'trigger':131C 'utf':74C 'via':79C 'walk':154C 'wallet':165C,182C 'write':146C 'xor':107C 'xor-obfusc':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T21:02:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-19143","url":"https://osv.dev/vulnerability/MAL-2026-19143","severity":"critical","published_at":"2026-11-11T21:02:24+00:00","modified_at":"2026-11-11T21:15:16+00:00","first_seen_at":"2026-11-11T21:29:24+00:00","fetched_at":"2026-11-11T21:29:24+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}