NPM Package With 56,000 Downloads Steals WhatsApp Credentials, Data

A malicious NPM package, Lotusbail, has been described as a WhatsApp Web API library that steals users’ data while providing legitimate functionality, according to SecurityWeek. The package, a fork of the Baileys library, has been available in the NPM repository for six months and has amassed over 56,000 downloads to date.

According to Koi Security, Lotusbail wraps the legitimate WebSocket client so that every message passes through the wrapper, enabling the theft of credentials, as well as all incoming and outgoing messages, with the information delivered to the malware operator. The malware encrypts collected data with a custom RSA implementation before transmission and has been observed hijacking WhatsApp’s device pairing process to add the attacker’s device, creating a backdoor access to victims’ accounts.

Uninstalling the package does not fully remove access, as victims must manually unlink all devices from WhatsApp’s settings, according to SecurityWeek.