txs-data@1.0.1

Analysis

Package txs-data@1.0.1 masquerades as an e-commerce transaction-data generator but contains a hidden second-stage dropper. The index.js exports a function that reads a companion file (test_address_list.js), removes a 0x prefix from each line, base64-decodes the result, and evals the decoded JavaScript. The decoded payload decodes a base64-embedded C2 URL pointing to dct0per[.]com/app/aws=, appends /bag.php, downloads the remote script via axios into the system temp directory (tmp_20260202), and executes it as a detached Python process using python3/python. The payload runs automatically whenever the exported getTransactions() function is called.