A malicious npm package masquerading as a WhatsApp Web API library has been discovered stealing users’ credentials and granting attackers persistent access to WhatsApp accounts.
The package, named “lotusbail”, mimics the legitimate @whiskeysockets/baileys library and has been available on npm for six months, registering over 56,000 downloads.
Functional Code Hides Advanced Malware
Unlike typical malicious packages that immediately exhibit suspicious behavior, Lotusbail operates as advertised.
It enables developers to send and receive WhatsApp messages via Node.js, thereby making the communication appear legitimate. However, while the library performs normal API operations, it secretly intercepts data that passes through it.
According to a Koi Security report, lotusbail captures sensitive data, including authentication tokens, session keys, complete message histories, contact lists, media files, and documents.
The malware inserts itself between the legitimate WebSocket communication layer and WhatsApp’s servers. Every piece of data, whether an incoming or outgoing message or an account credential, is copied and prepared for exfiltration.
What sets this attack apart is its custom-built RSA encryption system. Legitimate WhatsApp libraries don’t require extra encryption because WhatsApp already provides end-to-end security.
In this case, the attackers implemented RSA to encrypt stolen data before transmission, ensuring that traditional network monitoring tools couldn’t detect the exfiltration traffic.
Adding to the complexity, the malware conceals its command-and-control (C2) server with four layers of obfuscation: Unicode variable manipulation, LZString compression, Base-91 encoding, and AES encryption.
This multi-stage encoding effectively hides the C2 destination within the code, making it difficult to detect through static analysis.
Persistent Backdoor and Anti-Debugging Mechanisms
The attack doesn’t end with data theft. Lotusbail hijacks WhatsApp’s device-linking mechanism by embedding a hardcoded AES-encrypted pairing code.
When a user links their WhatsApp account via the library, the malware also silently links the attacker’s device. This provides continuous, undetected access even after the malicious package is uninstalled.
As a result, uninstalling lotusbail does not revoke the attacker’s access. Victims must manually unlink all connected devices in WhatsApp to entirely remove the threat.
To further evade analysis, the malicious library contains 27 anti-debugging traps, including checks for sandboxed environments, debuggers, and reverse-engineering tools. These loops freeze execution when inspection attempts are detected, frustrating researchers trying to analyze its behavior.
Koi Security researchers warn that the lotusbail incident illustrates how supply-chain attacks are evolving. Traditional static review methods and reputation-based security measures cannot reliably detect packages that deliver legitimate functionality while concealing malicious behavior.
The company emphasizes behavioral analysis as a necessary defense, monitoring what libraries actually do at runtime rather than relying purely on code inspection.
The lotusbail case stands as a stark reminder that even trusted open-source ecosystems can be weaponized against unsuspecting developers.
Follow us on Google News , LinkedIn and X to Get More Instant Updates, Set Cyberpress as a Preferred Source in Google.
