rand-txs-sdk

{"modified":"2026-08-19T06:57:38Z","published":"2026-08-19T06:57:38Z","schema_version":"1.7.4","id":"MAL-2026-14273","summary":"Malicious code in rand-txs-sdk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (383599a80e18acfe3bbf819e2c1cc5ec27a4663b2da9e18c7755000857196dc9)\nThe package advertises itself as a random-transaction generator but its exported getTransactions API triggers execution of a hidden code payload. load_transaction_data reads per-record 'mark' strings from database.js, applies a shift-cipher keyed by the caller-supplied count argument, base64-decodes the concatenated result, and passes the resulting bytes to the Function constructor invoked with Buffer, require, and process — granting the decoded code full Node.js privileges (filesystem, network, child process). The identifiers Function, require, process, Buffer, setTimeout, and clearTimeout are not present as plain strings; they are reconstructed at runtime by index-selecting fragments from a hidden character array and joined, and the Function constructor is retrieved indirectly through constructor.constructor on a global object. This string-splicing pattern is used specifically to hide the dynamic-execution sink from static analysis, and the combination of obfuscated global reconstruction plus execution of decoded data from a bundled data file is a loader-in-benign-wrapper attack shape rather than any behavior consistent with the stated purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"rand-txs-sdk"},"versions":["1.0.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"c0a1a7e54e1c759e62e48cfa835d79494163da3b37b30c1bd55c5875d9dd24f0","tlsh":"0ef10f6839f930248857b07c67eb9449612de0576e9a6ca87f4d83101f7d13ce1f6ba8"}],"package_integrity":[{"filename":"rand-txs-sdk-1.0.3.tgz","hashes":{"sha1":"2b7fea50f3b3e604119d443c6ba1f54a9e2b9080","sha512_sri":"sha512-WN1Q1Cp17K6KtstSS1eUao79KBqOF513btemuZ1LLP1NBiVe0zjdZaxIFKK9dzKpxowSDOi5kFwQ3FBuqRzupQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/rand-txs-sdk/v/1.0.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018385","import_time":"2026-08-19T07:21:21.471479482Z","modified_time":"2026-08-19T06:57:38Z","sha256":"383599a80e18acfe3bbf819e2c1cc5ec27a4663b2da9e18c7755000857196dc9","source":"amazon-inspector","versions":["1.0.3"]}]}}