Popular NPM Package lotusbail Exposed as Trojan Stealing WhatsApp Chats

Koi Security uncovers lotusbail, a malicious npm package with 56K downloads that steals WhatsApp messages and installs a persistent backdoor. Learn how to protect your data...

Malicious code in lotusbail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15f2dbbd6b5a88d7702bb519fe20f7f45ab5c4cf430900ca16912d055a6e2f3b The package lotusbail was found to contain malicious code. Source: ghsa-malware 9a89a3feaf56d39c9a953fb5de2e0f4ae6176dce75ee9d95baddc8ef83e59b91 Any...

EUVD-2025-204879

Malicious code in lotusbail npm...

MAL-2025-192748 Malicious code in lotusbail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15f2dbbd6b5a88d7702bb519fe20f7f45ab5c4cf430900ca16912d055a6e2f3b The package lotusbail was found to contain malicious code. Source: ghsa-malware 9a89a3feaf56d39c9a953fb5de2e0f4ae6176dce75ee9d95baddc8ef83e59b91 Any...

Malicious Package

Overview lotusbail is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...