MAL-2026-14258

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ranux-cloud/MAL-2026-14258.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14258
Published
2026-08-19T04:59:46Z
Modified
2026-08-19T05:31:27.697085844Z
Summary
Malicious code in ranux-cloud (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5c2844c37c95371d0fa96d0a814be948335590d5b65500a8f4b2a577c8748e23)

The package main (index.js) is obfuscator.io-transformed with a rotated string-array decoder and, at top level, uses createDecipheriv with a hardcoded AES key/iv/aad to decrypt an embedded ~2.3 MB opaque blob. The decrypted bytes are executed via a top-level await import('data:'+...) and the resulting module is re-exported as startRanuxEngine, so any consumer that requires or imports ranux-cloud immediately runs the hidden payload with no user interaction. In addition, package.json redirects the well-known dependency @whiskeysockets/baileys to github:rcedubot/X — an unrelated personal GitHub repository, unpinned to any commit SHA — so npm install pulls arbitrary code from that repo (including any lifecycle scripts) into the installer's dependency tree in place of the legitimate Baileys library. The combination of encrypted-payload import-time execution, heavy obfuscation of the loader, and a dependency-hijack pointing a namespaced dep at an attacker-controlled GitHub tree is the canonical loader/dropper shape.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T05:13:49.675563062Z",
            "sha256": "5c2844c37c95371d0fa96d0a814be948335590d5b65500a8f4b2a577c8748e23",
            "modified_time": "2026-08-19T04:59:46Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018370",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / ranux-cloud

Package

Name
ranux-cloud
View open source insights on deps.dev
Purl
pkg:npm/ranux-cloud

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ranux-cloud/MAL-2026-14258.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "14db404c3f50127f2be68e68284194e4e715f1c09366d286ec272b74739c1c4a",
            "path": "index.js",
            "tlsh": "83e54a281288d7b910ca6017c6b67a7b91acb0d7841d2edff27ca94d7f87c909e0f651"
        },
        {
            "sha256": "8ba2d8294f17b718ae4826bcbfc319d79bad5e7bb9a028f85b9d172d1b86dd70",
            "tlsh": "5ff09e12c954c97315c99ad49c9401437b6048074d05fc1c33a1a71cabdd1ef31b8bad",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "ranux-cloud-1.0.0.tgz",
            "hashes": {
                "sha1": "855dcc329a932bd28696b1bae5d26cebac0e2570",
                "sha512_sri": "sha512-5UygDqdzBasr5yXlMCJJPgaH/U+s1i/vtZp0tUmPs+NLH15sR40dz87DO3K0bi9OuRe5HHJML11Ot+qxIiczVw=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]