registry / Remote code execution / rand-tx-sdk

rand-tx-sdk

This package is used to generate random ecommerce transactions history data.

This report shows the evidence for rand-tx-sdk@1.0.6. 1 of 2 known versions is blocked or flagged. The newest version, 1.0.8, is allowed. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package hides a remote payload downloader and detached interpreter execution behind its advertised API. No lifecycle hook is needed for this consumer-triggered malicious execution path.

Static reason

One or more suspicious static signals were detected.

Trigger

Consumer calls getTransactions().

Impact

Remote operator controls code executed with the consuming user's privileges.

Mechanism

Obfuscated remote payload download and detached Python execution.

Attack narrative

The advertised transaction generator calls load_address_database. That function reconstructs tx_info_list.js and evals it. Static decoding of that embedded source shows it derives the listed endpoint, downloads its response if a predictable temp file is absent, writes the response to that file, then launches python or python3 detached with the file as its argument. This is a concrete remote-code-execution chain concealed from normal package use.

AI rationale

The package hides a remote payload downloader and detached interpreter execution behind its advertised API. No lifecycle hook is needed for this consumer-triggered malicious execution path.

Evidence

index.jstx_info_list.jspackage.json/tmp/tmp_20260521

Network endpoints1

dothebest.store/allow/inform.php

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

getTransactions invokes a loader that base64-decodes and evals hidden tx_info_list.js.
Static decoding reveals a fetch from https://dothebest.store/allow/inform.php.
The fetched response is written to /tmp/tmp_20260521 and executed by detached python/python3.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The payload activates when the advertised getTransactions API is called, not on import.

Behavioral surface

Source

EvalFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 6.17 KB of source

Source & flagged code

2 flagged

index.jsView file

16function load_tx(fileName, callback) { L17: fs.readFile(path.join(__dirname, fileName), 'utf8', (err, data) => { L18: if (err) { ... L131: const real_key = ""; L132: const data = Buffer.from(result, 'base64'); L133: eval(data.toString('utf-8')); L134: });

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.jsView on unpkg · L16

132const data = Buffer.from(result, 'base64'); L133: eval(data.toString('utf-8')); L134: });

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L132

Source & flagged code

2 flagged · loading source

index.jsView file

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.jsView on unpkg · L16

132const data = Buffer.from(result, 'base64'); L133: eval(data.toString('utf-8')); L134: });

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L132

Findings

1 High3 Low

HighObfuscated Payload Loaderindex.js

LowScripts Present

LowEvalindex.js

LowFilesystem

Affected versions and remediation

This report applies to rand-tx-sdk@1.0.6.

The versions list below shows the verdict for each recorded version.

Avoid installing rand-tx-sdk@1.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-17 01:59:07.837Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

1.0.8latestClean—AllowPublishedAug 17, 2026, 2:02 AM 1.0.6shownMaliciousRemote Code ExecutionBlockPublishedAug 17, 2026, 1:54 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Source & flagged code

Related packages

Other remote code execution packages