txs-builder@1.0.6

Analysis

txs-builder@1.0.6 is a trojanized package disguised as an ecommerce transaction-data generator. It ships a base64-encoded payload in test_address_list.js (with 0x-prefix obfuscation) that is decoded and eval'd when the package's exported getTransactions() function is called. The decoded code downloads a remote script from hxxps://kb4h5c83t[.]userdom[.]com/inform[.]php, writes it to the system's temporary directory as tmp_20260521, and executes it as a detached Python process. The final remote payload is fetched at runtime, making this a multi-stage downloader trojan.