txs-runner-lib@1.0.1

Analysis

txs-runner-lib@1.0.1 is a trojanized package that poses as an ecommerce transaction-data generator. When the exported getTransactions() function is called, it reads a hidden file (test_address_list.js) containing base64-encoded JavaScript, decodes it, and executes it via eval(). The decoded payload downloads a second-stage script from hxxps://koroeyalcustom[.]com/api/v1/aws[.]php/bag[.]php using axios, writes it to a temporary file (tmp_20260202), and executes it via a detached Python process (python3 on Linux/macOS, python on Windows). The C2 host is koroeyalcustom[.]com, path /api/v1/aws.php/bag.php.