ranux-cloud

{"modified":"2026-08-19T04:59:46Z","published":"2026-08-19T04:59:46Z","schema_version":"1.7.4","id":"MAL-2026-14258","summary":"Malicious code in ranux-cloud (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5c2844c37c95371d0fa96d0a814be948335590d5b65500a8f4b2a577c8748e23)\nThe package main (index.js) is obfuscator.io-transformed with a rotated string-array decoder and, at top level, uses createDecipheriv with a hardcoded AES key/iv/aad to decrypt an embedded ~2.3 MB opaque blob. The decrypted bytes are executed via a top-level `await import('data:'+...)` and the resulting module is re-exported as `startRanuxEngine`, so any consumer that requires or imports ranux-cloud immediately runs the hidden payload with no user interaction. In addition, package.json redirects the well-known dependency `@whiskeysockets/baileys` to `github:rcedubot/X` — an unrelated personal GitHub repository, unpinned to any commit SHA — so `npm install` pulls arbitrary code from that repo (including any lifecycle scripts) into the installer's dependency tree in place of the legitimate Baileys library. The combination of encrypted-payload import-time execution, heavy obfuscation of the loader, and a dependency-hijack pointing a namespaced dep at an attacker-controlled GitHub tree is the canonical loader/dropper shape.\n","affected":[{"package":{"ecosystem":"npm","name":"ranux-cloud"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"14db404c3f50127f2be68e68284194e4e715f1c09366d286ec272b74739c1c4a","tlsh":"83e54a281288d7b910ca6017c6b67a7b91acb0d7841d2edff27ca94d7f87c909e0f651"},{"path":"package.json","sha256":"8ba2d8294f17b718ae4826bcbfc319d79bad5e7bb9a028f85b9d172d1b86dd70","tlsh":"5ff09e12c954c97315c99ad49c9401437b6048074d05fc1c33a1a71cabdd1ef31b8bad"}],"package_integrity":[{"filename":"ranux-cloud-1.0.0.tgz","hashes":{"sha1":"855dcc329a932bd28696b1bae5d26cebac0e2570","sha512_sri":"sha512-5UygDqdzBasr5yXlMCJJPgaH/U+s1i/vtZp0tUmPs+NLH15sR40dz87DO3K0bi9OuRe5HHJML11Ot+qxIiczVw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ranux-cloud/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018370","import_time":"2026-08-19T05:13:49.675563062Z","modified_time":"2026-08-19T04:59:46Z","sha256":"5c2844c37c95371d0fa96d0a814be948335590d5b65500a8f4b2a577c8748e23","source":"amazon-inspector","versions":["1.0.0"]}]}}