MAL-2026-14273

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/rand-txs-sdk/MAL-2026-14273.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-14273
Published
2026-08-19T06:57:38Z
Modified
2026-08-19T07:31:56.204042310Z
Summary
Malicious code in rand-txs-sdk (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (383599a80e18acfe3bbf819e2c1cc5ec27a4663b2da9e18c7755000857196dc9)

The package advertises itself as a random-transaction generator but its exported getTransactions API triggers execution of a hidden code payload. loadtransactiondata reads per-record 'mark' strings from database.js, applies a shift-cipher keyed by the caller-supplied count argument, base64-decodes the concatenated result, and passes the resulting bytes to the Function constructor invoked with Buffer, require, and process — granting the decoded code full Node.js privileges (filesystem, network, child process). The identifiers Function, require, process, Buffer, setTimeout, and clearTimeout are not present as plain strings; they are reconstructed at runtime by index-selecting fragments from a hidden character array and joined, and the Function constructor is retrieved indirectly through constructor.constructor on a global object. This string-splicing pattern is used specifically to hide the dynamic-execution sink from static analysis, and the combination of obfuscated global reconstruction plus execution of decoded data from a bundled data file is a loader-in-benign-wrapper attack shape rather than any behavior consistent with the stated purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "383599a80e18acfe3bbf819e2c1cc5ec27a4663b2da9e18c7755000857196dc9",
            "versions": [
                "1.0.3"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018385",
            "import_time": "2026-08-19T07:21:21.471479482Z",
            "modified_time": "2026-08-19T06:57:38Z"
        }
    ]
}
References
Credits

Affected packages

npm / rand-txs-sdk

Package

Name
rand-txs-sdk
View open source insights on deps.dev
Purl
pkg:npm/rand-txs-sdk

Affected ranges

Affected versions

1.*
1.0.3

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "rand-txs-sdk-1.0.3.tgz",
            "hashes": {
                "sha512_sri": "sha512-WN1Q1Cp17K6KtstSS1eUao79KBqOF513btemuZ1LLP1NBiVe0zjdZaxIFKK9dzKpxowSDOi5kFwQ3FBuqRzupQ==",
                "sha1": "2b7fea50f3b3e604119d443c6ba1f54a9e2b9080"
            }
        }
    ],
    "evidence_files": [
        {
            "sha256": "c0a1a7e54e1c759e62e48cfa835d79494163da3b37b30c1bd55c5875d9dd24f0",
            "path": "index.js",
            "tlsh": "0ef10f6839f930248857b07c67eb9449612de0576e9a6ca87f4d83101f7d13ce1f6ba8"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/rand-txs-sdk/MAL-2026-14273.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]