NPM PACKAGE WITH 56K DOWNLOADS CAUGHT STEALING WHATSAPP MESSAGES

Summary from the TLDR InfoSec newsletter

The lotusbail npm package masqueraded as a legitimate WhatsApp Web API fork with functional code while secretly intercepting authentication tokens, messages, contacts, and media files through a malicious WebSocket wrapper. The malware employed sophisticated evasion techniques, including custom RSA encryption, four-layer obfuscation, 27 anti-debugging traps, and a hardcoded pairing code that established persistent backdoor access surviving package removal. Security professionals should implement behavioral runtime analysis to detect anomalous activities, such as custom encryption in communication libraries, and manually unlink all devices from WhatsApp settings if compromised.