A malicious npm package with more than 56,000 downloads masquerades as a working WhatsApp Web API library, and then it steals messages, harvests credentials and contacts, and hijacks users' WhatsApp accounts. According to Koi Security, the lotusbail npm package has been available for download for six months, and it's especially dangerous because the code works. "This one actually functions as a WhatsApp API," Koi Security researcher Tuval Admoni said in a Sunday blog. "It's based on the legitimate Baileys library and provides real, working functionality for sending and receiving WhatsApp messages." In addition to working as advertised, the secret-stealing library, which is a fork of the legitimate @whiskeysockets/baileys package, uses WebSocket to communicate with WhatsApp. However, this means that every WhatsApp communication passes through the socket wrapper, allowing it to capture your credentials when you log in and intercept messages as they are sent and received. "All your WhatsApp authentication tokens, every message sent or received, complete contact lists, media files - everything that passes through the API gets duplicated and prepared for exfiltration," Admoni wrote. The malware also uses a custom RSA implementation to encrypt the data, plus four layers of obfuscation - Unicode manipulation, LZString compression, Base-91 encoding, and AES encryption - before sending the stolen info to an attacker-controlled server. Plus, it backdoors the user's WhatsApp account via...
Poisoned WhatsApp API package steals messages and accounts
The Register
·Jessica Lyons
·Published Dec 22, 2025
·Updated
Affected Software
2 affected components
npm lotusbail
npm @whiskeysockets/baileys
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses a malicious npm package that impersonates a WhatsApp Web API library and steals user messages and accounts.
2
What security implications are discussed in relation to the npm package?
The implications include unauthorized access to users' WhatsApp accounts, theft of messages, and harvesting of credentials and contacts.
3
What are the names of the affected npm packages mentioned in the article?
The affected npm packages are 'lotusbail' and '@whiskeysockets/baileys'.
4
How many downloads did the malicious npm package receive?
The malicious npm package was downloaded more than 56,000 times.
5
What actions are taken to mitigate the risks from the compromised npm package?
The article suggests that users should avoid using the malicious package and may need to change their WhatsApp credentials and secure their accounts.