Malicious NPM Package with 56K Downloads Steals WhatsApp Messages

Cybersecuritynews •Tushar Subhra Dutta • December 23, 2025

A dangerous npm package named “lotusbail” has been stealing WhatsApp messages and user data from thousands of developers worldwide. The package, which has been downloaded over 56,000 times, disguises itself as a legitimate WhatsApp Web API library while secretly running malware in the background. It presents itself as a fork of the trusted “@whiskeysockets/baileys” package, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious NPM Package Steals WhatsApp Data from 56,000 Users A malicious NPM package named 'lotusbail' has been downloaded over 56,000 times and is stealing WhatsApp messages and user data from developers worldwide. Disguised as a legitimate WhatsApp Web API library, it operates as a fork of the trusted '@whiskeysockets/baileys' package while running malware in the background. 4 sources 29

Malicious NPM Package with 56K Downloads Steals WhatsApp Messages

The full story

Extracted Entities

Attack Types (1)

Malware (1)

Platforms (1)

Tools (1)