Malicious code in txs-lib-sdk (npm)
The npm package txs-lib-sdk contains malicious code that executes arbitrary Node.js code with full filesystem, network, and child_process access when the advertised getTransactions() API is invoked. The attack uses multi-layer obfuscation including identifier reassembly, base64+Caesar encoding, and indirect constructor lookup to conceal a supply-chain loader.
- Disclosed
- Last updated
- Blast radius
- Any Node.js application that imports and uses the txs-lib-sdk package's getTransactions() API
- Ecosystems
- Attack vectors
- Affected entities
- txs-lib-sdknpm package containing malicious code
The txs-lib-sdk npm package was found to contain malicious code disguised within its documented API. When the getTransactions() function is called, it triggers an internal loader that reads a file named database.js (presented as a product catalog) and extracts encoded payloads from record fields.
The malicious payload is obfuscated through multiple layers: identifiers like 'setTimeout', 'Function', 'Buffer', 'require', and 'process' are reconstructed from split string arrays, the Function constructor is resolved indirectly via globalThis.constructor.constructor, and the actual code is base64-encoded with per-byte Caesar shift applied. The encoded payload is stored in JSON-shaped carrier files and executed via deferred setTimeout calls.
Upon execution, the injected code runs with full Node.js capabilities including filesystem access, network operations, and child process spawning. This grants the attacker complete control over the host system running any application that uses this package's documented API.
The multi-layer obfuscation has no legitimate purpose for a package presented as a transactions helper library and is characteristic of a supply-chain loader attack.
Indicators of compromise
- Packages
- txs-lib-sdk
Remediation
- Immediately remove txs-lib-sdk from all projects and dependencies
- Audit all systems that had txs-lib-sdk installed for signs of compromise (filesystem modifications, network connections, process execution logs)
- Review npm audit logs and package-lock.json files to identify when txs-lib-sdk was installed
- Rotate all credentials and secrets that may have been exposed on affected systems
- Consider the affected systems as potentially compromised and perform full security assessment
- Use npm audit to check for any remaining malicious dependencies
Sources
- GitHub Advisory GHSA-2p34-9h9g-7wf4 · GitHub Advisory Database
Cite this entry
"Malicious code in txs-lib-sdk (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-txs-lib-sdk-npm-yztzxz
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in 3-buildsight-web (npm)
The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.
npmCompromised package - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @syncraft-labs/vue (npm)
The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.
npmCompromised package