A malicious npm package named lotusbail, masquerading as a WhatsApp Web API library, has been found to steal WhatsApp messages, credentials, and contacts. This package has been available for at least six months and has…
5 articles · Updated December 22, 2025
Recent Intelligence Reports
Poisoned WhatsApp API package steals messages and accounts— Theregister · December 22, 2025