Fake WhatsApp API Package on npm Steals Messages, Contacts, and Login Tokens

A new malicious npm package called lotusbail masquerades as a WhatsApp API yet acts as a fully functional backdoor, capable of intercepting every message and linking the attacker’s device to a victim’s WhatsApp account. The package has been downloaded over 56,000 times since it was first uploaded to the registry by a user named “seiren_primrose” in May 2025, with 711 downloads occurring in the last week, and it remains available for download.

Specified capabilities include stealing authentication tokens and session keys, message history, contact lists with phone numbers, media files and documents, and sending the data to an attacker‑controlled URL in encrypted form, all while disguising its true function within a WebSocket wrapper. The malware also hijacks the device linking process to grant persistent access even after the package is uninstalled, and anti‑debugging features trap debugging tools in an infinite loop.

According to Koi Security, the library is triggered during normal usage when the developer connects to WhatsApp, enabling continuous access to chats and contacts.