random-transactions-sdk@1.0.1
Used to generate random transactions data
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe transaction API decodes concealed code and executes it, and the payload downloads and launches a remote file. This is unrelated to the package's stated purpose and constitutes remote code execution.
Static reason
No blocking static signals were detected.
Trigger
Calling getTransactions(10), or load_transaction_data(10), schedules execution after 100 ms.
Impact
The remote response is executed as a detached process with the caller's user privileges.
Mechanism
The package reverses a byte shift and base64 encoding in database.js, evaluates the resulting code, downloads a response, writes it to a temporary file, and launches it with Python.
Attack narrative
A call with count 10 causes the package to decode code concealed in database.js and execute it through a dynamically constructed function. That code downloads content from dothebest.store, saves it to /tmp/tmp_20260529, and launches it as a detached Python process. The package presents this path as part of generating random transactions, but the downloaded code is unrelated to that purpose.
AI rationale
The transaction API decodes concealed code and executes it, and the payload downloads and launches a remote file. This is unrelated to the package's stated purpose and constitutes remote code execution.
Evidence
index.jsdatabase.js/tmp/tmp_20260529
Network endpoints1
dothebest.store/empty.php
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Calling getTransactions with count 10 schedules loading and decoding database.js.
- The decoded database payload is passed to a dynamically constructed function with access to require and process.
- The decoded payload fetches https://dothebest.store/empty.php, saves the response as /tmp/tmp_20260529, and launches it with Python.
Evidence against
- The README describes the package as a random transaction data generator.
Behavioral surface
Filesystem
Source & flagged code
6 flaggedindex.jsView file
272const _loadFn = exports.load_transaction_data;
try {
_loadFn(count)
} catch(e) {
}
transactionsData.sort((a,b)=>a.timeStamp-b.timeStamp)
return transactionsData
}
exports.getTransactions = function(count=20){
if(count>10000){
return "Transa
High
Ai Review Evidence
Calling getTransactions with count 10 schedules loading and decoding database.js.
index.jsView on unpkg · L272203exports.load_transaction_data = function(count=20) {
let _timerId;
const _callback = () => {
const _blocks = [
() => {
const _loadFn = loadConfig;
const _result = _loadFn("database.js", count);
const _b
High
Ai Review Evidence
Calling getTransactions with count 10 schedules loading and decoding database.js.
index.jsView on unpkg · L20315function processData(data, key) {
const shift = key % 256;
const decoded = Buffer
.from(data,"base64")
.toString("latin1");
let result = "";
for (const c of decoded) {
result += String.from
High
Ai Review Evidence
The decoded database payload is passed to a dynamically constructed function with access to require and process.
Findings
6 High2 Low
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidencedatabase.js
HighAi Review Evidencedatabase.js
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to random-transactions-sdk@1.0.1.
See all versions of random-transactions-sdk for other recorded verdicts.
- Avoid installing random-transactions-sdk@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.