MAL-2026-14260

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ranux-pro/MAL-2026-14260.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14260
Published
2026-08-19T04:59:38Z
Modified
2026-08-19T05:31:26.941553030Z
Summary
Malicious code in ranux-pro (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (535aa6b18b45b3ade8ae934157747b2a3281c298e38c7a8aa308236ba3c941a2)

package.json advertises the package as a 'High-performance async network socket & runtime protocol engine', but the tarball ships a multi-tenant WhatsApp bot: lib/baileysMod.js, plugins/pair.js (WA pairing), plugins/antidelete.js, plugins/adult.js, tenantManager.js (~134KB), database.js backed by mongodb. The @whiskeysockets/baileys dependency is redirected to github:rcedubot/X — a personal GitHub account's repo named 'X', pinned to no commit SHA, so every install pulls whatever code that account currently hosts into node_modules and executes it when the package is loaded. Every JS file (command.js, config.js, database.js, tenantManager.js, lib/, plugins/) is emitted by obfuscator.io with rotated string arrays, control-flow flattening, and self-defending IIFEs, so all network destinations and command handlers are hidden inside encoded string arrays and no URL literals are recoverable by static inspection. The combination of a deceptive registry description, whole-package obfuscation, and a mutable personal-fork override of the WhatsApp protocol layer means installers receive attacker-mutable code at install/load time and, once paired, hand persistent control of the WhatsApp session to whoever owns the concealed endpoints in tenantManager.js.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "sha256": "535aa6b18b45b3ade8ae934157747b2a3281c298e38c7a8aa308236ba3c941a2",
            "modified_time": "2026-08-19T04:59:38Z",
            "import_time": "2026-08-19T05:13:49.585194482Z",
            "versions": [
                "2.0.0"
            ],
            "id": "IN-MAL-2026-018369"
        }
    ]
}
References
Credits

Affected packages

npm / ranux-pro

Package

Name
ranux-pro
View open source insights on deps.dev
Purl
pkg:npm/ranux-pro

Affected ranges

Affected versions

2.*
2.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ranux-pro/MAL-2026-14260.json"
indicators 
{
    "evidence_files": [
        {
            "tlsh": "acf0c912cd60887324c86ec59ca916437ba048070a05fc1c33e6a72cabdc0ef31b9bac",
            "sha256": "69acfa59626d5d0ab4c4baef4fe6afafa64c349dd928bd118e86924e1e55768b",
            "path": "package.json"
        },
        {
            "tlsh": "1564732253c17c41124b9fb7b71bb3e9fa195bbc704848abe214bd64f7ba502d6d0932",
            "sha256": "dad7bda183ba57d8994a707fe8ad646a34db1172e9ceff53906132a3b58be711",
            "path": "index.js"
        },
        {
            "tlsh": "cbd3a471b3c4bc81224b4f77771ff6e5e92969a975880c8be104bc54f7a9a06ebd0930",
            "sha256": "2ae368a37f83046ee23c076cedcc97bcb1c81540e0a3cab24e99637ac6a7fbe1",
            "path": "tenantManager.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "ranux-pro-2.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-zVaB9tx/VJR3S0PrR+efkP2QRbqXhHZYMlfXd3CE97fIsx5hjG0pF+ouje0M1wznNNRGJyZRLrNnVy81vcL2NQ==",
                "sha1": "d8d506884ae3762ce72cbe8174090f651f55e339"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]