⌘ + K

MAL-2026-11400

Dashboard / Malicious Package / MAL-2026-11400

MAL-2026-11400

Published: 30 Jul 2026Last Modified: 5 Aug 2026Aliases:

Summary: Malicious code in thedata (npm)

Details: Source: amazon-inspector (5e05613178114f2f3d9171f429a5b6aba8e1a525e07db22d150be81c02d6f595) The package's main entry (index.js) re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply readFileSync's apps/docs/app/rsa.db and apps/docs/app/des.db as UTF-8 strings. Both.db files are base64-encoded OpenSSL 'Salted__' ciphertext. The package contains no code that decrypts, uses, or otherwise interacts with these blobs, and no documented API beyond exposing them. The package name resembles 'Theta Data' per the README but the shipped functionality does not implement any such client. Installing or importing thedata by itself performs no network activity, no filesystem access outside its own directory, no credential reads, and no code execution — the encrypted payloads are inert unless a separate consumer supplies the decryption key. The shape (a nearly-empty library whose only purpose is to serve opaque encrypted content to another party) is unusual for a legitimate library but does not by itself establish installer harm from this package alone. Source: ghsa-malware (1a92a93e170cd900d44df29d9f451294b09f9138882739c1f1874a2e09c4f3a1) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Affected packages

Package

Name: thedata

Purl: pkg:npm/thedata

Affected ranges

Type: SEMVER

Events:

Introduced- 0

Fixed -None

Affected versions

1.0.6

1.0.0

1.0.11

1.0.10

1.0.8

1.0.13

1.0.12

1.0.2

1.0.4

1.0.7

1.0.5

1.0.1

1.0.9

1.0.3