NPM Package Mayhem: 56,000 Downloads Later, Your WhatsApp is Their WhatsApp!
Lotusbail, an NPM package with over 56,000 downloads, secretly steals WhatsApp credentials while functioning as a legitimate API. It intercepts messages and media, enabling attackers to control accounts. Even if you uninstall it, surprise! The hacker’s still got access, like that one friend who keeps your Netflix login.
Hot Take:
Who knew that downloading a simple API package could lead to your WhatsApp account turning into a virtual haunted house? With ghostly credentials flying around and phantom devices hijacking your account, it seems like Lotusbail is the latest trickster in the software pumpkin patch. Beware of packages that promise to do wonders, only to leave you wondering where all your private WhatsApp conversations went!
Key Points:
- Lotusbail, an NPM package, has been stealing WhatsApp credentials for six months.
- The package has over 56,000 downloads, cleverly disguising itself as a legitimate API.
- It intercepts messages and data, encrypting them with custom RSA before exfiltration.
- Lotusbail implements 27 anti-debugging traps to avoid detection.
- Continued access to accounts persists even after uninstallation unless manually unlinked.
Already a member? Log in here