npm Poison: Invisible WhatsApp Web Malware Hijacks 56,000 Accounts via Supply-Chain Attack

The security of the open-source software supply chain has been dealt another significant blow with the discovery of a highly sophisticated attack campaign distributing malware through the Node Package Manager (npm) registry. The campaign, which security analysts have dubbed 'npm Poison', leveraged a malicious package to hijack WhatsApp Web sessions, ultimately compromising an estimated 56,000 user accounts. This incident serves as a stark reminder of the trust-based vulnerabilities inherent in developer ecosystems and the catastrophic downstream effects of a single poisoned component.

The attack vector was a package named 'lotusbail', which was uploaded to the public npm registry. It was cleverly disguised as a legitimate library for integrating WhatsApp Web's functionality into applications, a common requirement for developers building customer service bots, notification systems, or automation tools. By masquerading as a useful utility, the package successfully entered the dependency trees of numerous projects.

Technical analysis reveals the malware's insidious operation. Upon installation and execution within a developer's project, 'lotusbail' would initiate a covert process to connect the victim's environment to a command-and-control (C2) server controlled by the attackers. Its primary function was to hijack active WhatsApp Web sessions. By intercepting the WebSocket connection and session credentials, the malware provided attackers with a live, undetectable mirror of the victim's WhatsApp account.

The level of access granted was comprehensive. Threat actors could read all incoming and outgoing messages—including private and group chats—in real-time. They could download sent and received media files, such as photos, videos, and documents. Furthermore, they gained full access to the victim's contact list. Most alarmingly, this access was persistent. Research indicates that even if a victim grew suspicious and deleted the WhatsApp application from their mobile phone, the hijacked Web session often remained active, leaving the attacker's backdoor open. The breach was only sealed when the user explicitly logged out from WhatsApp Web on all devices from within the mobile app's linked devices menu, a step many users are unaware of.

The attack's impact is twofold. First, it directly victimized the end-users whose accounts were compromised, leading to severe privacy violations and potential secondary attacks like phishing, blackmail, or corporate espionage. Second, it seriously compromised the developers who unknowingly incorporated the malicious package. Their systems could have been further exploited, and their reputations damaged by distributing tainted software to their own users.

This campaign exemplifies a modern supply-chain attack's hallmarks: the use of a trusted platform (npm), social engineering (a useful-looking package), and a focus on high-value data (WhatsApp communications). It bypasses traditional endpoint security measures by operating through a legitimate development tool and establishing a seemingly normal network connection.

For the cybersecurity community, this incident underscores several critical lessons:

1. Dependency Vetting is Non-Negotiable: Organizations must implement stricter controls over open-source dependencies, including automated scanning for known vulnerabilities and malicious code, and adherence to a 'minimum required dependencies' policy.
2. Runtime Application Self-Protection (RASP): Security controls that monitor application behavior in real-time can help detect anomalous activities like unexpected external network calls from a library.
3. Developer Security Training: Developers are the new perimeter. Training them to recognize suspicious packages, check author reputations, download counts, and commit histories is essential.
4. Zero-Trust for APIs and Sessions: Applications should implement mechanisms to detect and terminate anomalous sessions, such as concurrent logins from geographically impossible locations.

The malicious 'lotusbail' package has since been identified and removed from the npm registry. However, its temporary presence caused widespread damage. Any development team that utilized this package must conduct immediate audits of their projects, revoke all active WhatsApp Web sessions, and force password resets for affected services. As attackers continue to innovate, the industry's approach to securing the software supply chain must evolve with even greater urgency, moving from reactive takedowns to proactive, resilient defense-in-depth strategies.