The ts-rand-sdk package (version 1.0.2) masquerades as a random transactions SDK exposing a getTransactions(count) API. However, invoking this API triggers a hidden loader that reads a disguised database.js file containing base64-encoded and byte-shifted code fragments. These fragments are decoded and concatenated, then executed dynamically via a Function constructor obtained indirectly through globalThis.constructor.constructor. The executed payload receives Buffer, require, and process objects, granting it full Node.js runtime capabilities, including arbitrary filesystem, process, and network access. The package uses obfuscation techniques such as storing sensitive identifiers in fragmented strings and deferring execution with setTimeout to evade detection. The ~54KB of concealed code in database.js is the actual malicious payload, making the advertised functionality a facade for runtime code execution.

Any system with ts-rand-sdk version 1.0.2 installed or running is fully compromised, as the malicious payload can execute arbitrary code with full Node.js privileges. This includes unrestricted access to the filesystem, process control, and network operations. Consequently, all secrets, keys, and sensitive data stored on the compromised system should be considered exposed and must be rotated immediately. Removal of the package alone does not guarantee elimination of all malicious artifacts or backdoors introduced by the payload.

Remove the ts-rand-sdk package version 1.0.2 immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or accessible on the compromised machines, using a separate, trusted environment. Because the malicious payload grants full control over the system, consider a full forensic investigation and system rebuild to ensure no persistent backdoors remain. Patch status is not confirmed; no official fix or vendor advisory is available. Monitor for updates from the package repository or security advisories for any remediation.