MAL-2026-14260

Dashboard / Malicious Package / MAL-2026-14260

MAL-2026-14260

Summary: Malicious code in ranux-pro (npm)

Details: Source: amazon-inspector (535aa6b18b45b3ade8ae934157747b2a3281c298e38c7a8aa308236ba3c941a2) package.json advertises the package as a 'High-performance async network socket & runtime protocol engine', but the tarball ships a multi-tenant WhatsApp bot: lib/baileysMod.js, plugins/pair.js (WA pairing), plugins/antidelete.js, plugins/adult.js, tenantManager.js (~134KB), database.js backed by mongodb. The @whiskeysockets/baileys dependency is redirected to `github:rcedubot/X` — a personal GitHub account's repo named 'X', pinned to no commit SHA, so every install pulls whatever code that account currently hosts into node_modules and executes it when the package is loaded. Every JS file (command.js, config.js, database.js, tenantManager.js, lib/*, plugins/*) is emitted by obfuscator.io with rotated string arrays, control-flow flattening, and self-defending IIFEs, so all network destinations and command handlers are hidden inside encoded string arrays and no URL literals are recoverable by static inspection. The combination of a deceptive registry description, whole-package obfuscation, and a mutable personal-fork override of the WhatsApp protocol layer means installers receive attacker-mutable code at install/load time and, once paired, hand persistent control of the WhatsApp session to whoever owns the concealed endpoints in tenantManager.js.

References: https://www.npmjs.com/package/ranux-pro/v/2.0.0