MAL-2026-14258

Dashboard / Malicious Package / MAL-2026-14258

MAL-2026-14258

Summary: Malicious code in ranux-cloud (npm)

Details: Source: amazon-inspector (5c2844c37c95371d0fa96d0a814be948335590d5b65500a8f4b2a577c8748e23) The package main (index.js) is obfuscator.io-transformed with a rotated string-array decoder and, at top level, uses createDecipheriv with a hardcoded AES key/iv/aad to decrypt an embedded ~2.3 MB opaque blob. The decrypted bytes are executed via a top-level `await import('data:'+...)` and the resulting module is re-exported as `startRanuxEngine`, so any consumer that requires or imports ranux-cloud immediately runs the hidden payload with no user interaction. In addition, package.json redirects the well-known dependency `@whiskeysockets/baileys` to `github:rcedubot/X` — an unrelated personal GitHub repository, unpinned to any commit SHA — so `npm install` pulls arbitrary code from that repo (including any lifecycle scripts) into the installer's dependency tree in place of the legitimate Baileys library. The combination of encrypted-payload import-time execution, heavy obfuscation of the loader, and a dependency-hijack pointing a namespaced dep at an attacker-controlled GitHub tree is the canonical loader/dropper shape.

References: https://www.npmjs.com/package/ranux-cloud/v/1.0.0