“LotusBail” Trap: 56,000 Developers Downloaded a Fake WhatsApp API That Works perfectly—While Stealing Everything

A new investigation into a sophisticated npm supply chain attack reveals a package called lotusbail masquerading as a legitimate WhatsApp Web API library, fooling more than 56,000 developers over six months.

The package is a fork of the popular @whiskeysockets/baileys library and, while it allowed developers to build WhatsApp bots and integrations, it also delivered a malicious payload that exfiltrated credentials, intercepted messages, harvested contacts, and installed a persistent backdoor that encrypts data and communicates with the attackers’ server.

Researchers describe the malware as having the discipline of a commercial software vendor, including 27 infinite loop traps designed to freeze security researchers and sandbox detection to thwart analysis. Disturbingly, simply uninstalling the infected package does not remove the threat, as the backdoor persists and provides continued access even after the original file is removed.

The incident highlights a flaw in modern development workflows and how reputation systems can overlook malicious but functional packages, according to KOI Security.