Malicious code in txs-runner-sdk (npm)

The txs-runner-sdk npm package was published with a loader/dropper pattern designed to execute arbitrary code in any application that uses its primary API. The package advertises itself as generating random transaction data, but the getTransactions() method invokes load_transaction_data(), which reads an embedded database.js file containing base64-encoded payloads hidden in 'mark' fields.\n\nThe malicious code applies a per-character Caesar shift keyed by item count, base64-decodes the result, and passes the resulting bytes directly to eval() inside a try/catch block. This design ensures that any consumer calling the advertised API unknowingly executes attacker-authored JavaScript in their process.\n\nThe package declares dependencies on axios and python-shell, consistent with a stager pattern that could fetch or spawn additional payloads once the initial code executes. The mismatch between the stated purpose (random data generation) and the presence of dynamic code execution, combined with the double-encoded payload smuggling technique, indicates intentional malicious design.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.