MAL-2026-14259

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ranux-dev/MAL-2026-14259.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14259
Published
2026-08-19T04:59:57Z
Modified
2026-08-19T05:31:27Z
Summary
Malicious code in ranux-dev (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4dde928a7de2064f13b18847a56607605bd33f1331a57bb0be0ccf585fa5d86f)

package.json declares the dependency @whiskeysockets/baileys but resolves it from github:rcedubot/X instead of the npm registry. Installing ranux-dev pulls arbitrary, unpinned, mutable code from that personal GitHub account under the name of a widely-used WhatsApp Web library, and that code runs in the installer's Node process with full WhatsApp session and credential access. Every shipped source file (index.js, config.js, database.js, tenantManager.js, command.js, lib/.js, plugins/.js) is heavily obfuscated with obfuscator.io-style transforms and an RC4-over-base64 string decoder, so endpoints, credentials, and control flow cannot be reviewed statically. config.js exports a frozen SECRETS object with hardcoded encrypted strings alongside API_ENDPOINTS and NETWORK_CONFIG (MongoDB-shaped) constants. The combination — dependency substitution of a popular WhatsApp library from an unaffiliated GitHub account, uniform obfuscation across the tarball, a multi-tenant WhatsApp/MongoDB architecture, and shipped hardcoded credential-shaped constants — matches the session-harvester pattern in which installer WhatsApp sessions and tenant data are funneled to an author-controlled backend.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018371",
            "import_time": "2026-08-19T05:13:49.801244443Z",
            "modified_time": "2026-08-19T04:59:57Z",
            "sha256": "4dde928a7de2064f13b18847a56607605bd33f1331a57bb0be0ccf585fa5d86f",
            "source": "amazon-inspector",
            "versions": [
                "5.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / ranux-dev

Package

Name
ranux-dev
View open source insights on deps.dev
Purl
pkg:npm/ranux-dev

Affected ranges

Affected versions

5.*
5.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "7efe69b0f79537140a0b1fea3ab61c5bec3940ccb859c7046249094b99159bb2",
            "tlsh": "8ef0c011cc60886315cc69d49c9901076bb0481b0e04fc2c33de661cabdd0ef31b976c"
        },
        {
            "path": "config.js",
            "sha256": "8e192a5371b686e15d2c8415b0efa866201221e31e962ce849876a38178a377e",
            "tlsh": "7db2a6867bc13c52254747f73717f6e8e52a2c8576c8188ef200b85cf9d9a21ebad271"
        }
    ],
    "package_integrity": [
        {
            "filename": "ranux-dev-5.0.0.tgz",
            "hashes": {
                "sha1": "241bc1c44f85153d0154fa00b2f895981db2cf51",
                "sha512_sri": "sha512-Y8MDIFEHu3NAknpzCEm+q5VULcDA/lcmyAOYmUA8Cf6e1ptMi/gw1jpH5GXrCq0TrjXKaooBNhcJ3goYdfUjLQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ranux-dev/MAL-2026-14259.json"