If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (4dde928a7de2064f13b18847a56607605bd33f1331a57bb0be0ccf585fa5d86f)
package.json declares the dependency `@whiskeysockets/baileys` but resolves it from `github:rcedubot/X` instead of the npm registry. Installing ranux-dev pulls arbitrary, unpinned, mutable code from that personal GitHub account under the name of a widely-used WhatsApp Web library, and that code runs in the installer's Node process with full WhatsApp session and credential access. Every shipped source file (index.js, config.js, database.js, tenantManager.js, command.js, lib/*.js, plugins/*.js) is heavily obfuscated with obfuscator.io-style transforms and an RC4-over-base64 string decoder, so endpoints, credentials, and control flow cannot be reviewed statically. config.js exports a frozen `SECRETS` object with hardcoded encrypted strings alongside `API_ENDPOINTS` and `NETWORK_CONFIG` (MongoDB-shaped) constants. The combination — dependency substitution of a popular WhatsApp library from an unaffiliated GitHub account, uniform obfuscation across the tarball, a multi-tenant WhatsApp/MongoDB architecture, and shipped hardcoded credential-shaped constants — matches the session-harvester pattern in which installer WhatsApp sessions and tenant data are funneled to an author-controlled backend.