ranux-cloud @1.0.0

Summary

The package main (index.js) is obfuscator.io-transformed with a rotated string-array decoder and, at top level, uses createDecipheriv with a hardcoded AES key/iv/aad to decrypt an embedded ~2.3 MB opaque blob. The decrypted bytes are executed via a top-level await import('data:'+...) and the resulting module is re-exported as startRanuxEngine , so any consumer that requires or imports ranux-cloud immediately runs the hidden payload with no user interaction. In addition, package.json redirects the well-known dependency @whiskeysockets/baileys to github:rcedubot/X — an unrelated personal GitHub repository, unpinned to any commit SHA — so npm install pulls arbitrary code from that repo (including any lifecycle scripts) into the installer's dependency tree in place of the legitimate Baileys library. The combination of encrypted-payload import-time execution, heavy obfuscation of the loader, and a dependency-hijack pointing a namespaced dep at an attacker-controlled GitHub tree is the canonical loader/dropper shape.

Source: amazon-inspector (5c2844c37c95371d0fa96d0a814be948335590d5b65500a8f4b2a577c8748e23)