MAL-2026-14260

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ranux-pro/MAL-2026-14260.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14260
Published
2026-08-19T04:59:38Z
Modified
2026-08-19T05:31:26Z
Summary
Malicious code in ranux-pro (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (535aa6b18b45b3ade8ae934157747b2a3281c298e38c7a8aa308236ba3c941a2)

package.json advertises the package as a 'High-performance async network socket & runtime protocol engine', but the tarball ships a multi-tenant WhatsApp bot: lib/baileysMod.js, plugins/pair.js (WA pairing), plugins/antidelete.js, plugins/adult.js, tenantManager.js (~134KB), database.js backed by mongodb. The @whiskeysockets/baileys dependency is redirected to github:rcedubot/X — a personal GitHub account's repo named 'X', pinned to no commit SHA, so every install pulls whatever code that account currently hosts into node_modules and executes it when the package is loaded. Every JS file (command.js, config.js, database.js, tenantManager.js, lib/, plugins/) is emitted by obfuscator.io with rotated string arrays, control-flow flattening, and self-defending IIFEs, so all network destinations and command handlers are hidden inside encoded string arrays and no URL literals are recoverable by static inspection. The combination of a deceptive registry description, whole-package obfuscation, and a mutable personal-fork override of the WhatsApp protocol layer means installers receive attacker-mutable code at install/load time and, once paired, hand persistent control of the WhatsApp session to whoever owns the concealed endpoints in tenantManager.js.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-018369",
            "import_time":  "2026-08-19T05:13:49.585194482Z",
            "modified_time":  "2026-08-19T04:59:38Z",
            "sha256":  "535aa6b18b45b3ade8ae934157747b2a3281c298e38c7a8aa308236ba3c941a2",
            "source":  "amazon-inspector",
            "versions":  [
                "2.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / ranux-pro

Package

Name
ranux-pro
View open source insights on deps.dev
Purl
pkg:npm/ranux-pro

Affected ranges

Affected versions

2.*
2.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "package.json",
            "sha256":  "69acfa59626d5d0ab4c4baef4fe6afafa64c349dd928bd118e86924e1e55768b",
            "tlsh":  "acf0c912cd60887324c86ec59ca916437ba048070a05fc1c33e6a72cabdc0ef31b9bac"
        },
        {
            "path":  "index.js",
            "sha256":  "dad7bda183ba57d8994a707fe8ad646a34db1172e9ceff53906132a3b58be711",
            "tlsh":  "1564732253c17c41124b9fb7b71bb3e9fa195bbc704848abe214bd64f7ba502d6d0932"
        },
        {
            "path":  "tenantManager.js",
            "sha256":  "2ae368a37f83046ee23c076cedcc97bcb1c81540e0a3cab24e99637ac6a7fbe1",
            "tlsh":  "cbd3a471b3c4bc81224b4f77771ff6e5e92969a975880c8be104bc54f7a9a06ebd0930"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "ranux-pro-2.0.0.tgz",
            "hashes":  {
                "sha1":  "d8d506884ae3762ce72cbe8174090f651f55e339",
                "sha512_sri":  "sha512-zVaB9tx/VJR3S0PrR+efkP2QRbqXhHZYMlfXd3CE97fIsx5hjG0pF+ouje0M1wznNNRGJyZRLrNnVy81vcL2NQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ranux-pro/MAL-2026-14260.json"