ranux-pronpm
ranux-pro is a confirmed malicious npm package (MAL-2026-14260) that runs destructive / sabotage code (malicious version 2.0.0). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in ranux-pro (npm)
What this malware does
package.json advertises the package as a 'High-performance async network socket & runtime protocol engine', but the tarball ships a multi-tenant WhatsApp bot: lib/baileysMod.js, plugins/pair.js (WA pairing), plugins/antidelete.js, plugins/adult.js, tenantManager.js (~134KB), database.js backed by mongodb. The @whiskeysockets/baileys dependency is redirected to github:rcedubot/X — a personal GitHub account's repo named 'X', pinned to no commit SHA, so every install pulls whatever code that account currently hosts into node_modules and executes it when the package is loaded. Every JS file (command.js, config.js, database.js, tenantManager.js, lib/, plugins/) is emitted by obfuscator.io with rotated string arrays, control-flow flattening, and self-defending IIFEs, so all network destinations and command handlers are hidden inside encoded string arrays and no URL literals are recoverable by static inspection. The combination of a deceptive registry description, whole-package obfuscation, and a mutable personal-fork override of the WhatsApp protocol layer means installers receive attacker-mutable code at install/load time and, once paired, hand persistent control of the WhatsApp session to whoever owns the concealed endpoints in tenantManager.js.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Destructive / sabotageFind it
Search your lockfiles and build artifacts for ranux-pro (version 2.0.0).
If you installed it — respond
ranux-pro carries a destructive/sabotage payload. Remove it immediately, restore any affected data from clean backups, and verify integrity of build outputs that may have been tampered with.
Did it already run?
If ranux-pro was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks ranux-pro-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.