Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in ranux-dev (npm)

ranux-dev, an npm package, contained malicious code that substituted a popular WhatsApp library dependency with arbitrary code from an unaffiliated GitHub account. The package was heavily obfuscated and designed to harvest WhatsApp sessions and credentials from installers.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
All npm users who installed ranux-dev
Ecosystems
npm
Attack vectors
Compromised packageDependency confusion
Affected entities
  • ranux-devnpm package containing malicious code

ranux-dev is an npm package that was published with malicious intent. The package.json declares a dependency on @whiskeysockets/baileys (a widely-used WhatsApp Web library) but resolves it from github:rcedubot/X instead of the npm registry, pulling arbitrary and unpinned code from a personal GitHub account.

Installation of ranux-dev executes this substituted code in the installer's Node process with full access to WhatsApp sessions and credentials. Every source file in the package (index.js, config.js, database.js, tenantManager.js, command.js, lib/.js, plugins/.js) is heavily obfuscated using obfuscator.io-style transforms and RC4-over-base64 string decoding, preventing static analysis of endpoints, credentials, and control flow.

The package exports a frozen SECRETS object containing hardcoded encrypted strings alongside API_ENDPOINTS and NETWORK_CONFIG constants with a MongoDB-like structure. The combination of dependency substitution, uniform obfuscation, multi-tenant WhatsApp/MongoDB architecture, and hardcoded credential-shaped constants indicates a session-harvester pattern designed to funnel installer WhatsApp sessions and tenant data to an author-controlled backend.

The incident was identified and credited to the OpenSSF malicious-packages repository.

Indicators of compromise

Packages
  • ranux-dev

Remediation

  • Immediately uninstall ranux-dev from all systems
  • Audit npm package.json files and lock files for ranux-dev presence
  • Rotate any WhatsApp credentials or sessions that may have been exposed
  • Review audit logs for any suspicious activity from systems that installed ranux-dev
  • Consider regenerating MongoDB credentials if systems using ranux-dev had access to MongoDB instances
  • Monitor for unauthorized access to WhatsApp accounts or data exfiltration

Sources

  1. GitHub Advisory GHSA-gw3h-35m8-vwph · GitHub Advisory Database

Cite this entry

"Malicious code in ranux-dev (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-ranux-dev-npm-k23rco

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in stillm4ddpocs-demo-sprocket (npm)

    The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.

    npmCompromised packageDependency confusion
  2. resolvedcritical

    Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

    Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.

    npmDependency confusionCompromised package
  3. resolvedcritical

    Malicious code in lumen-pages-community (npm)

    lumen-pages-community@9.9.9 on npm contains malicious code that executes a postinstall hook to exfiltrate installer metadata (hostname, username, working directory, platform, Node version, CI environment, npm user-agent) to a hardcoded webhook.site URL. The high version number and lack of functionality suggest a dependency-confusion attack.

    npmCompromised packageDependency confusion
  4. resolvedcritical

    Malicious code in @gfe/lx-watcher (npm)

    The npm package @gfe/lx-watcher contained malicious code that exfiltrated host metadata (hostname, OS username, working directory, timestamp) via npm lifecycle hooks to a hardcoded webhook.site endpoint. The package exploited dependency confusion by using a scoped name (@gfe/*) with a no-op stub, allowing silent resolution against the public registry while leaking host identifiers.

    npmDependency confusionCompromised package