Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in ranux-cloud (npm)

The npm package ranux-cloud contains malicious code that executes hidden payloads at import time via encrypted blob decryption and obfuscation. Additionally, the package redirects the legitimate @whiskeysockets/baileys dependency to an attacker-controlled GitHub repository, enabling arbitrary code execution during installation.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any npm consumer of ranux-cloud package
Ecosystems
npm
Attack vectors
Compromised packageDependency confusion
Affected entities
  • ranux-cloudnpm package containing malicious code

The ranux-cloud npm package was found to contain multiple layers of malicious functionality. The main entry point (index.js) is obfuscated using obfuscator.io with a rotated string-array decoder and employs AES decryption with hardcoded keys to decrypt an embedded ~2.3 MB opaque blob at the top level. This decrypted payload is immediately executed via dynamic import, ensuring any consumer that requires or imports the package runs the hidden code without user interaction.

In addition to the encrypted payload execution, the package's package.json file redirects the well-known dependency @whiskeysockets/baileys to an unrelated personal GitHub repository (github:rcedubot/X) without pinning to a specific commit SHA. This dependency hijack causes npm install to pull arbitrary code from the attacker-controlled repository, including any lifecycle scripts, into the installer's dependency tree in place of the legitimate Baileys library.

The combination of encrypted-payload import-time execution, heavy obfuscation of the loader code, and dependency hijacking targeting a namespaced package represents a canonical loader/dropper attack pattern. The malicious package was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.

Indicators of compromise

Packages
  • ranux-cloud

Remediation

  • Remove ranux-cloud from all dependencies immediately
  • Audit npm install logs and dependency trees for any unexpected packages or versions pulled from github:rcedubot/X
  • Review and revoke any credentials or secrets that may have been exposed on systems where ranux-cloud was installed
  • Verify the integrity of @whiskeysockets/baileys by reinstalling from the legitimate npm registry
  • Monitor for any suspicious activity or lateral movement from affected systems
  • Update npm and use npm audit to detect similar malicious packages

Sources

  1. GitHub Advisory GHSA-rw66-6gm9-9xfm · GitHub Advisory Database

Cite this entry

"Malicious code in ranux-cloud (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-ranux-cloud-npm-242kk5

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

    Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.

    npmDependency confusionCompromised package
  2. containedcritical

    Malicious code in stillm4ddpocs-demo-sprocket (npm)

    The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.

    npmCompromised packageDependency confusion
  3. resolvedcritical

    Malicious code in lumen-pages-community (npm)

    lumen-pages-community@9.9.9 on npm contains malicious code that executes a postinstall hook to exfiltrate installer metadata (hostname, username, working directory, platform, Node version, CI environment, npm user-agent) to a hardcoded webhook.site URL. The high version number and lack of functionality suggest a dependency-confusion attack.

    npmCompromised packageDependency confusion
  4. resolvedcritical

    Malicious code in @gfe/lx-watcher (npm)

    The npm package @gfe/lx-watcher contained malicious code that exfiltrated host metadata (hostname, OS username, working directory, timestamp) via npm lifecycle hooks to a hardcoded webhook.site endpoint. The package exploited dependency confusion by using a scoped name (@gfe/*) with a no-op stub, allowing silent resolution against the public registry while leaking host identifiers.

    npmDependency confusionCompromised package