rand-tx-sdk@1.0.6

One or more suspicious static signals were detected.

Consumer calls getTransactions().

Remote operator controls code executed with the consuming user's privileges.

Obfuscated remote payload download and detached Python execution.

The advertised transaction generator calls load_address_database. That function reconstructs tx_info_list.js and evals it. Static decoding of that embedded source shows it derives the listed endpoint, downloads its response if a predictable temp file is absent, writes the response to that file, then launches python or python3 detached with the file as its argument. This is a concrete remote-code-execution chain concealed from normal package use.

The package hides a remote payload downloader and detached interpreter execution behind its advertised API. No lifecycle hook is needed for this consumer-triggered malicious execution path.