Malicious code in ts-rand-sdk (npm)

The npm package ts-rand-sdk was published with malicious code embedded in its database.js file. The package advertised a simple API (getTransactions) but contained a hidden loader mechanism that was triggered during normal usage.\n\nThe attack used multiple obfuscation techniques: sensitive identifiers (setTimeout, Function, Buffer, require, process) were fragmented across a string array and reassembled at runtime; the malicious payload (~54KB) was base64-encoded and stored in database records' mark fields; and execution was deferred via setTimeout to evade static analysis. The loader decoded these fragments, applied per-record byte shifts, and passed the resulting JavaScript to a Function constructor obtained indirectly via globalThis.constructor.constructor.\n\nThe constructed function was invoked with Buffer, require, and process as arguments, granting the decoded payload full Node.js runtime capabilities including arbitrary filesystem access, process execution, and network operations. The product-catalog framing was purely a cover for the code-execution loader.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages project.