MAL-2026-14199 Malicious code in txs-runner-sdk (npm)

The package advertises itself as generating random transaction data, but its main API method getTransactions() invokes load_transaction_data(), which reads database.js (a JSON file whose records carry base64-encoded 'mark' fields), applies a per-character Caesar shift keyed by an item count, base64-decodes the concatenated result, and passes the resulting bytes to eval() inside a try/catch. The.js-suffixed data file, the double-encoded payload smuggled as product 'mark' fields, and the mismatch between the stated purpose (random data generation) and the presence of dynamic code execution together form a loader/dropper pattern: any consumer that calls the advertised API executes attacker-authored JavaScript in the calling process. Declared dependencies include axios and python-shell, consistent with a stager that fetches or spawns further payloads once the decoded code runs.