random-transactions-sdk@1.0.4
Used to generate random transactions data
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe transaction-generation path automatically decodes and runs concealed code for a particular count. That code downloads a remote response and executes it with Python, which is malicious remote code execution.
Static reason
No blocking static signals were detected.
Trigger
Calling getTransactions(10) causes the loader to decode and run the hidden payload.
Impact
Runs downloaded code on the caller's machine, enabling arbitrary actions with the process user's privileges.
Mechanism
The payload stored in database.js is decoded and passed to a dynamically constructed function. It downloads a response, saves it under the system temporary directory, and launches that file with Python as a detached process.
Attack narrative
Calling getTransactions(10) reaches a delayed loader that decodes code concealed in database.js and executes it through a dynamically constructed function. The decoded code fetches https://dothebest.store/allow/empty.php, writes the response to a temporary file, and launches it with Python in a detached process. This behavior is unrelated to generating transaction data.
AI rationale
The transaction-generation path automatically decodes and runs concealed code for a particular count. That code downloads a remote response and executes it with Python, which is malicious remote code execution.
Evidence
index.jsdatabase.js${os.tmpdir()}/tmp_20260529
Network endpoints1
dothebest.store/allow/empty.php
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The transaction API calls a delayed loader as part of generating results.
- The loader reads database.js, decodes its records, and passes the result to a dynamically constructed function.
- Decoding the stored records with the key used by getTransactions(10) reveals code that fetches https://dothebest.store/allow/empty.php, writes the response to a temporary file, and launches it with Python in a detached process.
Evidence against
- The package describes itself as a random transaction data generator, but the concealed download-and-execute behavior is unrelated to that purpose.
Behavioral surface
Filesystem
Source & flagged code
5 flaggedindex.jsView file
303try {
exports.load_transaction_data(count)
} catch(e) {
}
transactionsData.sort((a,b)=>a.timeStamp-b.timeStamp)
return transact
High
Ai Review Evidence
The transaction API calls a delayed loader as part of generating results.
index.jsView on unpkg · L30331function loadConfig(filename, count) {
const records = JSON.parse(
fs.readFileSync(
path.join(__dirname, filename),
"utf8"
)
);
records.s
High
Ai Review Evidence
The loader reads database.js, decodes its records, and passes the result to a dynamically constructed function.
index.jsView on unpkg · L31203exports.load_transaction_data = function(count=20) {
let _timerId;
const _callback = () => {
const _blocks = [
() => {
const _loadFn = loadConfig;
const _result = _loadFn("database.js", count);
const _bufferFrom = Buffer.from;
const _data = _bufferFrom(_result, "base64");
const _toString = _data.toString.bind(_data);
High
Ai Review Evidence
Findings
5 High2 Low
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidencedatabase.js
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to random-transactions-sdk@1.0.4.
See all versions of random-transactions-sdk for other recorded verdicts.
- Avoid installing random-transactions-sdk@1.0.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.