Malicious code in rand-txs-sdk (npm)

The rand-txs-sdk npm package (version 1.0.3) exports a getTransactions API that triggers execution of a hidden payload. This payload is constructed by reading 'mark' strings from a bundled data file, applying a shift cipher keyed by a caller-supplied argument, base64-decoding the result, and passing the decoded bytes to the Function constructor. The Function constructor is accessed indirectly via constructor.constructor on a global object, and critical identifiers such as Function, require, process, and Buffer are reconstructed at runtime from fragments of a hidden character array to evade static detection. This technique enables the execution of arbitrary code with full Node.js privileges, including filesystem, network, and child process capabilities. The attack pattern is a loader-in-benign-wrapper, where the malicious payload is hidden inside an otherwise legitimate-looking package.

An attacker or user invoking the getTransactions API in rand-txs-sdk version 1.0.3 will cause execution of arbitrary code with full Node.js privileges. This includes access to the filesystem, network, and ability to spawn child processes, which can lead to system compromise, data exfiltration, or further malicious activity. The obfuscation and dynamic code execution make detection difficult through static analysis.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using rand-txs-sdk version 1.0.3 and remove it from your environment if present. Monitor for updates from the package maintainer or npm security advisories regarding remediation or removal.