ranux-cloud@1.0.0

Analysis

ranux-cloud@1.0.0 ships a single obfuscated entry file (index.js, ~3.1MB) that acts as a loader. On require, it imports node:crypto, constructs a decipher, decrypts a large embedded encrypted blob, and executes the decrypted payload, then wipes the key/IV/auth-tag buffers from memory. The code is obfuscated with a large encoded string array and custom decoder, so the payload's behaviour is not visible statically. No network endpoint was observed in the static analysis; the package's stated purpose (a network socket/protocol engine) is not substantiated by any readable implementation.