Malicious npm package steals WhatsApp accounts and messages

A malicious npm package called 'lotusbail', a fork of the Baileys WhatsApp Web client, was available on npm for at least six months and amassed over 56,000 downloads; it wraps the WebSocket client to capture WhatsApp authentication tokens, messages, contacts, and media, exfiltrates data (using multiple layers of obfuscation and encryption), and can persistently link an attacker to a victim's WhatsApp account via device pairing, so developers are advised to remove the package and check for linked devices.