The ts-rand-sdk package (version 1.0.2) masquerades as a random transactions SDK exposing a single API, getTransactions(count). When used as documented, it triggers a hidden loader function that reads a file named database.js containing approximately 54KB of base64-encoded code fragments in a 'mark' field. These fragments are decoded and byte-shifted based on the count parameter, concatenated in order, and base64-decoded again to produce JavaScript source code. This source is then executed dynamically using a Function constructor obtained indirectly via globalThis.constructor.constructor. The executed code receives Buffer, require, and process objects, granting it full Node.js capabilities including arbitrary filesystem, process, and network access. The package uses string fragment reassembly and deferred execution via setTimeout to obfuscate the payload path and evade review. The advertised product catalog framing is a cover for this runtime code execution loader.

Successful use of the ts-rand-sdk package version 1.0.2 results in execution of arbitrary JavaScript code with full Node.js privileges on the host system. This enables an attacker to perform any action available to the Node.js process, including reading and writing files, executing system commands, and network communication. The malicious code is concealed and dynamically reconstructed at runtime, making detection difficult. This poses a severe risk of system compromise, data theft, or further malware deployment.

No official patch or remediation is currently available for ts-rand-sdk version 1.0.2. Users should immediately cease using this package and remove it from their environments. Avoid installing or running this package from untrusted sources. Monitor for any updates or advisories from the package maintainers or npm registry regarding remediation. Since this is a malicious package, do not attempt to run or debug it in production environments.