txs-random-lib@1.0.1

Analysis

txs-random-lib@1.0.1 is a trojanized package that poses as a random e-commerce transaction generator. When the exported getTransactions() function is called, it reads a hex-encoded file (test_address_list.js), base64-decodes it, and evaluates the result. The decoded payload downloads a remote script from kcthermal[.]shop/auth/val.php/bag.php via HTTP GET and executes it using a detached Python process (python3 on Linux/macOS, python on Windows). The downloaded script is written to /tmp/tmp_20260202 before execution. The C2 host is kcthermal[.]shop.