MAL-2026-14258 Malicious code in ranux-cloud (npm)

The package main (index.js) is obfuscator.io-transformed with a rotated string-array decoder and, at top level, uses createDecipheriv with a hardcoded AES key/iv/aad to decrypt an embedded ~2.3 MB opaque blob. The decrypted bytes are executed via a top-level await import('data:'+...) and the resulting module is re-exported as startRanuxEngine, so any consumer that requires or imports ranux-cloud immediately runs the hidden payload with no user interaction. In addition, package.json redirects the well-known dependency @whiskeysockets/baileys to github:rcedubot/X — an unrelated personal GitHub repository, unpinned to any commit SHA — so npm install pulls arbitrary code from that repo (including any lifecycle scripts) into the installer's dependency tree in place of the legitimate Baileys library. The combination of encrypted-payload import-time execution, heavy obfuscation of the loader, and a dependency-hijack pointing a namespaced dep at an attacker-controlled GitHub tree is the canonical loader/dropper shape.