Malicious code in ranux-cloud (npm)

The ranux-cloud npm package (version 1.0.0) includes a top-level loader that decrypts an approximately 2.3 MB opaque blob using a hardcoded AES key, then executes the decrypted module immediately upon import via a dynamic data URI import. The loader is heavily obfuscated, employing a rotated string-array decoder. Furthermore, the package.json file redirects the legitimate dependency '@whiskeysockets/baileys' to an unpinned attacker-controlled GitHub repository, causing npm install to fetch and execute arbitrary code from that repository, including any lifecycle scripts. This combination of encrypted payload execution and dependency hijacking constitutes a loader/dropper malware pattern.

Any user or system that installs or imports ranux-cloud version 1.0.0 will execute the hidden malicious payload automatically, potentially leading to arbitrary code execution. The dependency hijack further allows the attacker to inject arbitrary code during installation, increasing the attack surface and risk of compromise. There is no indication of active exploitation in the wild at this time.

No official patch or remediation is currently documented. Users should avoid installing or importing ranux-cloud version 1.0.0. Verify dependencies carefully and do not trust packages that redirect dependencies to untrusted sources. Monitor vendor advisories for updates or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.