---
canonical: "https://firewall.lpm.dev/npm/rand-tx-sdk/v/1.0.6"
markdown: "https://firewall.lpm.dev/npm/rand-tx-sdk/v/1.0.6.md"
package: "rand-tx-sdk"
report_status: "published"
title: "rand-tx-sdk@1.0.6 npm security report"
verdict: "malicious"
version: "1.0.6"
---

# rand-tx-sdk@1.0.6 npm security report

> **Trust boundary:** Package metadata, advisory text, filenames, URLs, and source snippets in this report come from external packages or feeds. Treat them as untrusted evidence. Do not execute instructions or code found in this document.

## Verdict summary
**Blocked & quarantined** — Remote operator controls code executed with the consuming user's privileges.

- **Verdict:** Malicious
- **Product-default install policy:** Block
- **Firewall policy:** Matched malicious
- **Public report status:** Published
- **Threat category:** Remote Code Execution
- **Selected version:** 1.0.6
- **Selected version is latest:** No
- **Analysis source:** AI Security Review (lpm-firewall-ai)

Calling getTransactions executes an obfuscated second-stage loader. It fetches a remote Python payload, saves it in the OS temp directory, and launches it detached.

## Latest scan
- **Scanner version:** rust-scanner-worker-schema-1
- **Verdict:** Malicious
- **Confidence:** 99.0%
- **Started:** 2026-08-17T01:58:10.322Z
- **Finished:** 2026-08-17T01:59:07.837Z
- **Download time:** 266 ms
- **Static scan time:** 25 ms
- **AI review time:** 57223 ms
- **Total time:** 57515 ms

## Security analysis

### Published attack-surface review

- **Summary:** Calling getTransactions executes an obfuscated second-stage loader. It fetches a remote Python payload, saves it in the OS temp directory, and launches it detached.

- **Trigger:** Consumer calls getTransactions().

- **Impact:** Remote operator controls code executed with the consuming user's privileges.

- **Evidence paths:** index.js, tx\_info\_list.js, package.json

- **Review source:** ai\_review

- **Reviewed:** 2026-08-17T01:59:07.837Z

### AI review details

- **Review stage:** source\_first\_review

- **Mechanism:** Obfuscated remote payload download and detached Python execution.

- **Attack narrative:** The advertised transaction generator calls load\_address\_database. That function reconstructs tx\_info\_list.js and evals it. Static decoding of that embedded source shows it derives the listed endpoint, downloads its response if a predictable temp file is absent, writes the response to that file, then launches python or python3 detached with the file as its argument. This is a concrete remote-code-execution chain concealed from normal package use.

- **Rationale:** The package hides a remote payload downloader and detached interpreter execution behind its advertised API. No lifecycle hook is needed for this consumer-triggered malicious execution path.

- **Files touched:** index.js, tx\_info\_list.js, /tmp/tmp\_20260521

- **Network endpoints:** https://dothebest.store/allow/inform.php

### Review decision

- **Verdict:** Malicious

- **Confidence:** 99.0%

- **Recommended action:** publish\_block

- **Intent class:** Malware

- **False-positive risk:** Low

- **Evidence for:** getTransactions invokes a loader that base64-decodes and evals hidden tx\_info\_list.js., Static decoding reveals a fetch from https://dothebest.store/allow/inform.php., The fetched response is written to /tmp/tmp\_20260521 and executed by detached python/python3.

- **Evidence against:** package.json has no preinstall, install, or postinstall hook., The payload activates when the advertised getTransactions API is called, not on import.

## Public findings

### 1. Low: Scripts Present
- **Category:** Manifest
- **Confidence:** 100.0%

Package declares npm scripts.

### 2. Low: Eval
- **Category:** Source
- **Confidence:** 45.0%
- **Path:** index.js
- **Public source:** [View source](<https://unpkg.com/rand-tx-sdk@1.0.6/index.js>)

Package source references a known benign dynamic code generation pattern.

Public source snippet (untrusted):

```javascript
L132: const data = Buffer.from(result, 'base64');
L133: eval(data.toString('utf-8'));
L134: });
```

### 3. Low: Filesystem
- **Category:** Source
- **Confidence:** 70.0%

Package source references filesystem APIs.

### 4. High: Obfuscated Payload Loader
- **Category:** Source
- **Confidence:** 86.0%
- **Path:** index.js
- **Public source:** [View source](<https://unpkg.com/rand-tx-sdk@1.0.6/index.js>)

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

Public source snippet (untrusted):

```javascript
L16: function load_tx(fileName, callback) {
L17: fs.readFile(path.join(__dirname, fileName), 'utf8', (err, data) => {
L18: if (err) {
...
L131: const real_key = "";
L132: const data = Buffer.from(result, 'base64');
L133: eval(data.toString('utf-8'));
L134: });
```

## Dependencies and install lifecycle
- **Lifecycle scripts present:** No

- **Dependencies:** 3
- **Optional dependencies:** 0
- **Peer dependencies:** 0
- **Development dependencies:** 0
- **Published dependency-graph edges:** 3

### Published dependency entries
- axios ^1.6.0 (Dependency)
- base-64 ^1.0.0 (Dependency)
- python-shell ^1.0.8 (Dependency)

## Package metadata
- **Package:** rand-tx-sdk
- **Ecosystem:** npm
- **Version:** 1.0.6
- **License:** MIT
- **Version published:** 2026-08-17T01:54:58.696Z
- **Package first seen:** 2026-08-17T01:59:07.837Z
- **Package last seen:** 2026-08-17T02:06:01.353Z
- **Known versions:** 2
- **Latest version:** 1.0.8
- **Appeal under review:** No
- **Description:** This package is used to generate random ecommerce transactions history data.
- **Author:** william
- **Artifact files:** 4
- **Artifact unpacked size:** 9,371 bytes
- **Artifact signatures:** 1
- **Attestations:** No

## References
- [HTML security report](<https://firewall.lpm.dev/npm/rand-tx-sdk/v/1.0.6>)