random-transactions-sdk@1.0.1

Analysis

random-transactions-sdk is a disguised code loader. Although index.js advertises itself as a random-transaction data generator, its getTransactions() function also calls a hidden load_transaction_data() that, from a 100ms timer, loads package/database.js, base64-decodes the short "mark" strings of the 334 decoy product records (e.g. U01LcVNN, S3FTTUtx), applies a per-character rotation keyed on the supplied count, concatenates the results and base64-decodes them into a JavaScript source string. The recovered code is executed with the Function constructor obtained through global.constructor.constructor — passing Buffer, require and process into the generated code — while the identifiers "Function", "Buffer", "require" and "process" are assembled from split string fragments to hide them. Errors are swallowed both inside the loader and in the caller. The executed payload is not fixed in the package: it is derived from the encoded fragments at runtime, so its content depends on the count argument and any network, file or credential access happens after decode. database.js is 43KB of filler used to look like ordinary sample data. No documented reason exists for a random-data helper to decode and execute code.