GCVE-110-OSM-2026-10754

package.json declares the dependency `@whiskeysockets/baileys` but resolves it from `github:rcedubot/X` instead of the npm registry. Installing ranux-dev pulls arbitrary, unpinned, mutable code from that personal GitHub account under the name of a widely-used WhatsApp Web library, and that code runs in the installer's Node process with full WhatsApp session and credential access. Every shipped source file (index.js, config.js, database.js, tenantManager.js, command.js, lib/*.js, plugins/*.js) is heavily obfuscated with obfuscator.io-style transforms and an RC4-over-base64 string decoder, so endpoints, credentials, and control flow cannot be reviewed statically. config.js exports a frozen `SECRETS` object with hardcoded encrypted strings alongside `API_ENDPOINTS` and `NETWORK_CONFIG` (MongoDB-shaped) constants. The combination — dependency substitution of a popular WhatsApp library from an unaffiliated GitHub account, uniform obfuscation across the tarball, a multi-tenant WhatsApp/MongoDB architecture, and shipped hardcoded credential-shaped constants — matches the session-harvester pattern in which installer WhatsApp sessions and tenant data are funneled to an author-controlled backend. ENTRY index.js (main: index.js) EXFIL - System Information Exfiltration in plugins/adult.js: "__filename=fileURLToPath(import.meta.url),__dirname=_0x134857[_0x50f3b3(0x819,0x..." - System Information Exfiltration in plugins/ai.js: "__filename=fileURLToPath(import.meta.url),__dirname=_0x122951[_0x1c03ae(0x326,0x..." - System Information Exfiltration in plugins/creater.js: "__filename=fileURLToPath(import.meta.url),__dirname=_0x59532f[_0x6f6a72(0x30,-0x..." - System Information Exfiltration in plugins/csong.js: "__filename=fileURLToPath(import.meta.url),__dirname=_0x2d0465[_0x397ba7(0x7c,0x1..." - System Information Exfiltration in plugins/pair.js: "__filename=fileURLToPath(import.meta.url),__dirname=_0x5e567e[_0x428b71(0x229,'j..." - System Information Exfiltration in plugins/settings.js: "__filename=fileURLToPath(import.meta.url),__dirname=_0x504a23[_0x3e5f5e(0x87,0x3..." OBFUSCATION - Obfuscation: augmented proxied array function replacements in command.js - Obfuscation: augmented proxied array function replacements in config.js - Obfuscation: augmented proxied array function replacements in database.js - Obfuscation: augmented proxied array function replacements in index.js - Obfuscation: augmented proxied array function replacements in lib/baileysMod.js - Obfuscation: augmented proxied array function replacements in lib/context.js - Obfuscation: augmented proxied array function replacements in lib/functions.js - Obfuscation: augmented proxied array function replacements in lib/logger.js (+265 more) ADDITIONAL FINDINGS - Campaign marker: Contagious Interview 2026 in plugins/download.js: "_0x1c18" - Very New NPM Publisher Account - Campaign marker: Contagious Interview Malicious Dictionary in plugins/animetv.js: "_0x28aa" PAYLOAD FILES plugins/adult.js (+ plugins/animetv.js, plugins/download.js)