txs-lib-sdk

{"modified":"2026-08-19T01:17:26Z","published":"2026-08-19T01:17:26Z","schema_version":"1.7.4","id":"MAL-2026-14198","summary":"Malicious code in txs-lib-sdk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5575013ead36c1ebb523009215200be0a1bf61d21285ca8515573963a63e3aa5)\nThe package's advertised getTransactions() API invokes an internal loader that reads database.js — a file disguised as a product catalog — extracts each record's `mark` field, base64-decodes it and applies a per-byte Caesar shift, concatenates the result into a code string, and passes it to the Function constructor together with Buffer, require, and process. This yields arbitrary Node.js execution with full filesystem, network, and child_process capabilities on the caller's host whenever the documented API is used. index.js hides the sink by reconstructing the identifiers 'setTimeout', 'Function', 'Buffer', 'require', and 'process' from a split string-array and by resolving the Function constructor indirectly via globalThis.constructor.constructor. The multi-layer obfuscation (identifier reassembly, indirect constructor lookup, base64+Caesar-encoded payload, JSON-shaped carrier file, deferred setTimeout) has no legitimate purpose for a package presented as a transactions helper and is the concealment layer of a supply-chain loader.\n","affected":[{"package":{"ecosystem":"npm","name":"txs-lib-sdk"},"versions":["1.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"c0a1a7e54e1c759e62e48cfa835d79494163da3b37b30c1bd55c5875d9dd24f0","tlsh":"0ef10f6839f930248857b07c67eb9449612de0576e9a6ca87f4d83101f7d13ce1f6ba8"}],"package_integrity":[{"filename":"txs-lib-sdk-1.0.2.tgz","hashes":{"sha1":"50ecafed1e2e1dc44734289055f64dc1bebb3a5e","sha512_sri":"sha512-O97tStb5/aXDgBuTUVQLYbI6BX5nj+cisfAkuQ6MTL23XjWrZfEarSObUHANOFCqLZp3u1lukB1WwixbEcWcew=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/txs-lib-sdk/v/1.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018277","import_time":"2026-08-19T01:34:41.768858733Z","modified_time":"2026-08-19T01:17:26Z","sha256":"5575013ead36c1ebb523009215200be0a1bf61d21285ca8515573963a63e3aa5","source":"amazon-inspector","versions":["1.0.2"]}]}}