Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in ranux-pro (npm)

The npm package ranux-pro contained malicious code disguised as a network socket library. The package shipped a multi-tenant WhatsApp bot with obfuscated code and a mutable dependency override pointing to a personal GitHub account, allowing attackers to execute arbitrary code at install and runtime.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
All npm users who installed ranux-pro
Ecosystems
npm
Attack vectors
Compromised packageMalicious commit
Affected entities
  • ranux-pronpm package containing malicious WhatsApp bot code

The npm package ranux-pro was published with deceptive metadata advertising itself as a "High-performance async network socket & runtime protocol engine," but the actual tarball contained a fully functional multi-tenant WhatsApp bot implementation.

The malicious payload included WhatsApp bot components (lib/baileysMod.js, plugins/pair.js for WA pairing, plugins/antidelete.js, plugins/adult.js), a tenant manager (~134KB), and a MongoDB-backed database. All JavaScript files were heavily obfuscated using obfuscator.io with rotated string arrays, control-flow flattening, and self-defending IIFEs to hide network destinations and command handlers.

A critical attack vector was the override of the @whiskeysockets/baileys dependency, redirected to github:rcedubot/X — a personal GitHub account's repository named 'X' with no pinned commit SHA. This meant every installation would pull whatever code the attacker currently hosted into node_modules and execute it at load time, allowing mutable code injection.

Once a user paired their WhatsApp session with the bot, persistent control of the session was handed to the attacker's concealed endpoints in tenantManager.js. The combination of deceptive packaging, whole-package obfuscation, and a mutable personal-fork dependency override created a sophisticated supply chain attack.

Indicators of compromise

Packages
  • ranux-pro

Remediation

  • Immediately uninstall ranux-pro from all systems
  • Audit npm install logs to identify when ranux-pro was installed
  • If installed, assume WhatsApp sessions and credentials may be compromised; change WhatsApp passwords and review account activity
  • Remove any paired WhatsApp sessions from affected devices
  • Scan systems for persistence mechanisms or additional malware installed by the bot
  • Add ranux-pro to npm blocklists and dependency scanning tools
  • Review and pin all GitHub-based dependencies to specific commit SHAs to prevent mutable code injection

Sources

  1. GitHub Advisory GHSA-2gp5-gf42-pm83 · GitHub Advisory Database

Cite this entry

"Malicious code in ranux-pro (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-ranux-pro-npm-1wnmxr

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in rust-testing-utils (npm)

    The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.

    npmCompromised packageMalicious commit
  2. resolvedcritical

    Malicious code in @syncraft-labs/core (npm)

    The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.

    npmCompromised packageMalicious commit
  3. resolvedcritical

    Malicious code in localize-translate (npm)

    The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.

    npmCompromised packageMalicious commit
  4. containedcritical

    Malicious code in mutex-plus (npm)

    The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.

    npmCompromised packageMalicious commit