The ranux-dev npm package version 5.0.0 declares a dependency on @whiskeysockets/baileys but resolves it from a personal GitHub repository (github:rcedubot/X) rather than the official npm registry. This causes arbitrary, mutable code to be executed during installation with full access to the installer's WhatsApp sessions and credentials. The package's source files are uniformly obfuscated using obfuscator.io-style transformations and an RC4-over-base64 string decoder, preventing static review of endpoints, credentials, and control flow. The config.js exports a frozen SECRETS object containing hardcoded encrypted strings alongside API_ENDPOINTS and NETWORK_CONFIG constants shaped like MongoDB configurations. This combination of dependency substitution, obfuscation, and embedded credential-like constants matches a session-harvester pattern, where WhatsApp sessions and tenant data are exfiltrated to an attacker-controlled backend.

Users installing ranux-dev version 5.0.0 risk executing malicious code that can access and exfiltrate WhatsApp session credentials and tenant data to an attacker-controlled backend. This compromises the confidentiality and integrity of WhatsApp sessions and potentially any associated MongoDB tenant data managed by the package. The obfuscation and hardcoded encrypted secrets make detection and analysis difficult, increasing the risk of unnoticed data theft.

No official patch or remediation is currently documented for ranux-dev version 5.0.0. Users should avoid installing or using this package version. Verify all dependencies are resolved from trusted sources, especially for critical libraries like WhatsApp Web clients. Monitor for vendor advisories or updates that address this malicious dependency substitution. Consider removing ranux-dev 5.0.0 from environments and replacing it with verified, trusted alternatives.