Malicious code in txs-lib-sdk (npm)

The txs-lib-sdk npm package (version 1.0.2) includes a malicious backdoor triggered via its advertised getTransactions() API. This API internally loads a disguised JSON file (database.js) containing a base64-encoded and Caesar-shifted payload in the 'mark' field. The payload is decoded, concatenated, and executed dynamically using the Function constructor, which is accessed indirectly via globalThis.constructor.constructor. The executed code has full access to Node.js capabilities including filesystem, network, and child process execution. The package uses multi-layer obfuscation techniques such as splitting and reassembling identifiers ('setTimeout', 'Function', 'Buffer', 'require', 'process') and deferred execution to conceal this behavior. This constitutes a supply-chain attack vector allowing arbitrary code execution on any system using this package.

Systems with txs-lib-sdk version 1.0.2 installed are fully compromised, as the package enables arbitrary code execution with full Node.js privileges. This can lead to complete system takeover, data theft, secret/key exposure, and persistent backdoors. The compromise extends beyond the package itself, as attackers may have installed additional malicious software. Immediate secret/key rotation is required for affected systems.

No official patch or fix is currently available for this malicious package version. The package should be immediately removed from all systems. All secrets and keys stored on compromised systems must be rotated from a secure, unaffected environment. Due to the full system compromise risk, assume persistent backdoors may exist and conduct a thorough incident response. Monitor for any suspicious activity related to this package. Patch status is not yet confirmed — check vendor advisories or trusted sources for updates.