MAL-2026-14259

    Dashboard / Malicious Package / MAL-2026-14259

    MAL-2026-14259

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in ranux-dev (npm)

    Details: Source: amazon-inspector (4dde928a7de2064f13b18847a56607605bd33f1331a57bb0be0ccf585fa5d86f) package.json declares the dependency `@whiskeysockets/baileys` but resolves it from `github:rcedubot/X` instead of the npm registry. Installing ranux-dev pulls arbitrary, unpinned, mutable code from that personal GitHub account under the name of a widely-used WhatsApp Web library, and that code runs in the installer's Node process with full WhatsApp session and credential access. Every shipped source file (index.js, config.js, database.js, tenantManager.js, command.js, lib/*.js, plugins/*.js) is heavily obfuscated with obfuscator.io-style transforms and an RC4-over-base64 string decoder, so endpoints, credentials, and control flow cannot be reviewed statically. config.js exports a frozen `SECRETS` object with hardcoded encrypted strings alongside `API_ENDPOINTS` and `NETWORK_CONFIG` (MongoDB-shaped) constants. The combination — dependency substitution of a popular WhatsApp library from an unaffiliated GitHub account, uniform obfuscation across the tarball, a multi-tenant WhatsApp/MongoDB architecture, and shipped hardcoded credential-shaped constants — matches the session-harvester pattern in which installer WhatsApp sessions and tenant data are funneled to an author-controlled backend.

    References: https://www.npmjs.com/package/ranux-dev/v/5.0.0

    Affected packages

    Package

    Name: ranux-dev

    Purl: pkg:npm/ranux-dev

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    5.0.0
    MAL-2026-14259 | CVE-DB