txnforge@1.0.4
Used to generate realistic synthetic financial transaction data for testing, development, and simulation.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package conceals a downloader in encoded data and triggers it through the advertised transaction-generation API for count 10. It executes an unverified Python file from an unrelated host, which is malicious remote code execution.
Static reason
No blocking static signals were detected.
Trigger
Calling getTransactions(10), which passes the count into the delayed loader.
Impact
The remote server can supply arbitrary code for execution on the user's machine.
Mechanism
The loader decodes shifted base64 data from database.js, constructs a function from it, fetches a script with Axios, writes it to the OS temp directory, and starts it with Python in a detached process.
Attack narrative
Calling getTransactions(10) triggers the loader, which reconstructs concealed code from database.js and executes it dynamically. That code downloads a Python script from dothebest.store, saves it as tmp_20260529 in the OS temp directory, then launches it as a detached process. The downloaded script is not verified before execution.
AI rationale
The package conceals a downloader in encoded data and triggers it through the advertised transaction-generation API for count 10. It executes an unverified Python file from an unrelated host, which is malicious remote code execution.
Evidence
index.jsdatabase.jsos.tmpdir()/tmp_20260529
Network endpoints1
dothebest.store/allow/empty.php
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package describes itself as a synthetic transaction generator and exports index.js as its main entry point.
- index.js reads database.js and base64-decodes its records using a shift controlled by the supplied count.
- The decoded database content is passed to a dynamically constructed function.
- getTransactions passes its count to the loader, which runs the callback after a 100 ms timer.
- With count 10, the decoded payload fetches a Python file from https://dothebest.store/allow/empty.php, saves it in the OS temp directory as tmp_20260529, and launches it with python or python3.
Evidence against
- The manifest has no install lifecycle hook; the malicious behavior is triggered when the transaction-generation API is called.
Behavioral surface
Filesystem
Source & flagged code
7 flaggedpackage.jsonView file
1{
"name": "txnforge",
"version": "1.0.4",
"description": "Used to generate realistic synthetic financial transaction data for testing, development, and simulation.",
"main": "index.js",
"dependencies": {
"p
High
Ai Review Evidence
The package describes itself as a synthetic transaction generator and exports index.js as its main entry point.
package.jsonView on unpkg · L1index.jsView file
15function processData(data, key) {
const shift = key % 256;
const decoded = Buffer
.from(data,"base64")
.toString("latin1");
let result = "";
for (const c of decoded) {
result += String.from
High
Ai Review Evidence
index.js reads database.js and base64-decodes its records using a shift controlled by the supplied count.
index.jsView on unpkg · L15210const _result = _loadFn("database.js", count);
const _bufferFrom = Buffer.from;
const _data = _bufferFrom(_result, "base64");
const _toString = _data.toString.bind(_data);
const _code = _toString("utf-8");
Findings
7 High2 Low
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidencedatabase.js
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to txnforge@1.0.4.
See all versions of txnforge for other recorded verdicts.
- Avoid installing txnforge@1.0.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.