Malicious code in rand-txs-sdk (npm)

The npm package rand-txs-sdk was found to contain malicious code disguised within its advertised random-transaction generator functionality. When the exported getTransactions API is invoked, it triggers execution of a hidden code payload.\n\nThe attack mechanism uses a loader-in-benign-wrapper pattern. The load_transaction_data function reads 'mark' strings from a bundled database.js file, applies a shift-cipher transformation keyed by a caller-supplied count argument, base64-decodes the result, and passes the decoded bytes to the Function constructor. This grants the decoded code full Node.js privileges including filesystem access, network operations, and child process execution.\n\nTo evade static analysis detection, the code reconstructs sensitive identifiers (Function, require, process, Buffer, setTimeout, clearTimeout) at runtime by index-selecting fragments from a hidden character array rather than using plain strings. The Function constructor itself is retrieved indirectly through constructor.constructor on a global object. This obfuscation pattern combined with execution of data from a bundled file is characteristic of supply chain attacks rather than legitimate functionality.\n\nThe vulnerability was identified by the OpenSSF malicious-packages project and reported via GitHub Advisory GHSA-27g5-wp43-2h3q.