{"answers":{"affected":"1 open source package ship an affected version, including ranux-dev.","exploited":"There is no known exploitation of MAL-2026-14259 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-14259 is a malicious package in ranux-dev, published on 19 Aug 2026."},"fix_prompt":"MAL-2026-14259 is a malicious package: ranux-dev (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-14259/ (Markdown: https://insights.sbomify.com/MAL-2026-14259/index.md)","id":"MAL-2026-14259","markdown":"https://insights.sbomify.com/MAL-2026-14259/index.md","name":"MAL-2026-14259","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"package.json declares the dependency `@whiskeysockets/baileys` but resolves it from `github:rcedubot/X` instead of the npm registry. Installing ranux-dev pulls arbitrary, unpinned, mutable code from that personal GitHub account under the name of a widely-used WhatsApp Web library, and that code runs in the installer's Node process with full WhatsApp session and credential access. Every shipped source file (index.js, config.js, database.js, tenantManager.js, command.js, lib/*.js, plugins/*.js) is heavily obfuscated with obfuscator.io-style transforms and an RC4-over-base64 string decoder, so endpoints, credentials, and control flow cannot be reviewed statically. config.js exports a frozen `SECRETS` object with hardcoded encrypted strings alongside `API_ENDPOINTS` and `NETWORK_CONFIG` (MongoDB-shaped) constants. The combination — dependency substitution of a popular WhatsApp library from an unaffiliated GitHub account, uniform obfuscation across the tarball, a multi-tenant WhatsApp/MongoDB architecture, and shipped hardcoded credential-shaped constants — matches the session-harvester pattern in which installer WhatsApp sessions and tenant data are funneled to an author-controlled backend.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in ranux-dev (npm)","id":"MAL-2026-14259","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"ranux-dev","purl":"pkg:npm/ranux-dev","source":"MAL-2026-14259"}],"products":null,"published":"2026-08-19","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-14259/"}