Malicious code in txs-runner-sdk (npm)

The txs-runner-sdk npm package (version 1.0.1) advertises functionality for generating random transaction data. However, its main API method getTransactions() calls load_transaction_data(), which reads a JSON file containing base64-encoded 'mark' fields. These fields are processed with a per-character Caesar shift keyed by an item count, concatenated, base64-decoded, and then executed dynamically using eval() inside a try/catch block. This dynamic code execution is a loader/dropper pattern, allowing execution of attacker-authored JavaScript within the calling process. The package's declared dependencies on axios and python-shell suggest it may fetch or spawn additional payloads after initial execution. This behavior represents a malicious package designed to execute arbitrary code under the guise of legitimate functionality.

Any consumer invoking the getTransactions() API method in txs-runner-sdk version 1.0.1 will execute attacker-controlled JavaScript code within their environment. This can lead to arbitrary code execution, potentially allowing further payload delivery, data compromise, or system control depending on the attacker's intent. The malicious code is embedded in the package itself and triggered by normal API usage, posing a direct supply chain risk to users of this package.

No official patch or remediation is currently documented for txs-runner-sdk version 1.0.1. Users should immediately cease using this package and remove it from their projects. Verify dependencies and replace this package with a trusted alternative. Monitor for updates from the package maintainer or npm advisory channels for any official fixes or removal notices. Until a fix is available, avoid executing code from this package to prevent arbitrary code execution.