NPM package with 56,000 downloads compromises WhatsApp accounts

Security researchers from Koi Security have warned about an NPM package called Lotusbail, a WhatsApp Web API library and fork of Baileys, which has been stealing users’ credentials and data. The package has been available for six months and has eclipsed 56,000 downloads, making it a fully functional WhatsApp API that intercepts credentials, messages, contacts and media while continuing to operate normally.

Lotusbail wraps WhatsApp’s WebSocket client, enabling the attacker to capture information and maintain control, with all stolen data encrypted using a custom RSA before exfiltration and heavily obfuscated server details.

The malware uses 27 anti‑debugging traps to detect analysis tools and even includes comments in the code, suggesting a highly professional, well‑organised supply chain attack; it also hijacks WhatsApp’s device pairing process with a hardcoded code encrypted with AES, secretly linking the attacker’s device to the victim’s account. According to Koi Security, the threat actor has a key to the WhatsApp account, granting complete, persistent access even after uninstalling the package until devices are manually unlinked.