NPM package was caught stealing WhatsApp Messages.
Cybersecurity researchers have discovered a malicious package on npm. This package mimics the WhatsApp API, meaning it actually enables WhatsApp automation. Therefore, developers might mistake it for a normal, useful library, but internally, it is highly dangerous.
The name of this package is lotusbail. It was uploaded to the npm website by a user named seiren_primrose. This package is available from May 2025. So far, more than 56,000 people have downloaded it. There have been 711 downloads in the last week alone. This means that people are still installing this dangerous package. Many developers are not aware that this is harmful.
It appears to be the WhatsApp Web API library, but in reality, it is a copy (fork) of the popular and secure package @whiskeysockets/baileys. Its code also works, so the developers have no doubts.
If you install this package, it steals your WhatsApp login details, reads and copies all your WhatsApp messages, steals your contact data, creates a permanent backdoor in the system that means a hacker can access it later, and sends all the stolen data encrypted to the hacker’s server.
How does it work?
The cover is original.
Typically, bad npm package names are misleading, don’t work, or look suspicious at first glance. But this package works just like the original WhatsApp API, sending and receiving messages normally. It’s based on the original Baileys library, so the developers don’t suspect anything. That’s the trick: developers think, “If the code works, it must be secure.” For this reason, it gets installed, tested, approved, and deployed into production.
Theft and Exfiltration.
When you talk to someone on WhatsApp, this package acts as a middleman between WhatsApp and your app. Every message first goes to the malware, and then reaches WhatsApp. When you log in, it steals your credentials. When a message comes in, it makes a copy of it, or when you send a message, it records it. WhatsApp API continues to operate normally; Malware just silently makes copies.
How is data sent secretly?
This malware does not send data in plain text; It uses its own custom RSA encryption. This means that it sends the data in encrypted form. WhatsApp’s library does not require additional encryption, so the only reason for this custom cryptography is to prevent stolen data from being detected by network monitoring.
The Backdoor
From this point, the attack becomes very serious. WhatsApp usually provides a pairing code to add a new device. You enter the code, and the device is linked. But what the malware does is that it hijacks the pairing process. There is a hardcoded pairing code hidden inside the package. This means that when you log in, both your app and the hacker’s device are linked to WhatsApp, and you don’t even know it.
What can a hacker do?
Once the connection is made, the hacker gets complete control: they can read all your messages, send messages in your name, download photos, videos, and documents, and see your entire contact list. Simply put, your entire WhatsApp account is in the hands of the hacker.
The most dangerous part is that you think, “I uninstalled the package, I am safe,” but uninstalling the npm package only deletes the malicious code; the hacker’s device is still linked with WhatsApp because the WhatsApp device pairing is saved on WhatsApp’s servers, and access remains until you manually unlink.
What does a security company do?
A security company isn’t limited to just removing malware. It identifies advanced NPM supply-chain attacks like Lotasbell and prevents them from being installed. Even if some threats manage to slip through, it protects against WhatsApp hijacking and other forms of damage. Whether you need help with ransomware attacks, other cybersecurity issues, or simply want to speak with an expert, Ransom Security is there for you.
Found this article interesting? Explore more ransomware security insights and threat updates.
Frequently Asked Questions
Lotusbell pretends to be a real npm package, just like the real WhatsApp API. It looks normal, works normally, so most developers don’t think too much about it. But the real thing is that it is actually malware. By installing it, you hand over your WhatsApp login, your messages, and even your contact list. The matter does not end here. Lotusbell lets hackers enter through a backdoor and encrypts all stolen data before sending it. That’s not even the worst thing. Everything continues to work as if nothing has happened, so no one notices anything. And even if you delete the package, the hacker still probably has a way to get in.
The malware used its own RSA encryption, so any data it stole wasn’t just sent in plain text. This made it very difficult to catch. Typically, the standard WhatsApp library doesn’t require any extra encryption—WhatsApp already has end-to-end encryption built in. So if you see a WhatsApp package adding its own encryption on top, that’s a big red flag. They are definitely trying to hide something.
Normally, to add a new device to WhatsApp, a pairing code is generated. The user enters the code, and the device is securely linked. What does malware do? It secretly controls this pairing process. A pairing code is already hard-coded (fixed) inside the package, and this code is linked to the hacker’s device.
Once the hacker’s device is linked to your WhatsApp account, they get complete control.
A hacker can do all this:
Can read all your WhatsApp messages
Can send messages with your name
Photos, videos, and documents can be downloaded
You can see your entire contact list
Can access private chats and business chats
Call Now — 24/7 Ransomware Help
If you’re under attack, call now. We’ll start safe containment, preserve evidence, and stand up a clean landing zone. No contracts required to start.
Call 316‑712‑4006
I am at risk, Save me!