MAL-2026-14199

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (db9d5d94b7f75bbe8bca33eb382bfb986e68b7f0307cad7e9626da103192f254) The package advertises itself as generating random transaction data, but its main API method getTransactions() invokes load_transaction_data(), which reads database.js (a JSON file whose records carry base64-encoded 'mark' fields), applies a per-character Caesar shift keyed by an item count, base64-decodes the concatenated result, and passes the resulting bytes to eval() inside a try/catch. The.js-suffixed data file, the double-encoded payload smuggled as product 'mark' fields, and the mismatch between the stated purpose (random data generation) and the presence of dynamic code execution together form a loader/dropper pattern: any consumer that calls the advertised API executes attacker-authored JavaScript in the calling process. Declared dependencies include axios and python-shell, consistent with a stager that fetches or spawns further payloads once the decoded code runs.