Malicious NPM Package Hits 56K Downloads, Steals WhatsApp Messages

Cybersecurity: Compromise of npm Registry via Malicious Package

A recent malware campaign has infiltrated the npm registry through a package that imitates legitimate WhatsApp API functionality while covertly exfiltrating authentication credentials, messages, contacts, and media files from developers.

The "lotusbail" package was downloaded over 56,000 times during its six-month availability on npm. This incident represents a significant evolution in supply chain attacks, where functional code hides sophisticated data theft operations.

The package masquerades as a fork of the legitimate @whiskeysockets/baileys library, providing genuine WhatsApp Web API capabilities.

Unlike typical malicious packages, which may be detected through broken functionality or obvious typosquatting, "lotusbail" delivers a working interface for WhatsApp message handling. This allows it to pass code reviews and testing phases, ultimately reaching production environments where traditional security measures fail to detect its malicious nature.

Weaponizing Trust Through Working Code

The malware operates by manipulating WebSocket connections, intercepting all messages flowing through the application. It wraps the legitimate WhatsApp communication channel, capturing session tokens and authentication keys during the authentication process.

All incoming and outgoing messages pass through the malware's socket wrapper, creating a surveillance mechanism that duplicates WhatsApp activity without disrupting functionality.

Stolen data is encrypted using custom RSA encryption before exfiltration, making detection by network monitoring tools difficult. This custom cryptographic implementation is unnecessary for a WhatsApp library, as WhatsApp already provides end-to-end encryption.

The malware employs four layers of obfuscation to hide the exfiltration server's location: Unicode variable manipulation, LZString compression, Base-91 encoding, and AES encryption. The server URL is not visible in plaintext within the package code.

This backdoor persists independently of the npm package; uninstalling the malicious library removes the code but leaves the attacker's device linked to the victim's WhatsApp account until manually disconnected through WhatsApp's device management settings.

The attack exploits WhatsApp's device pairing process. The malware contains a hardcoded pairing code encrypted with AES, embedded in the package.

During application authentication, developers unknowingly link the attacker's device to their WhatsApp account, granting the attacker full account control. The attacker can read messages, send messages as the victim, download media files, and access contact lists.

The package includes 27 infinite loop traps to detect debugging tools, sandbox environments, and dynamic analysis attempts, preventing security researchers from examining the malware's behavior during execution.

This attack highlights the need for runtime behavioral analysis capable of detecting anomalies, such as custom encryption implementations and anti-debugging mechanisms in packages claiming to provide standard API functionality.

Based on reporting by GBHackers.