Fake WhatsApp API Package on npm Steals Messages, Contacts, and Login Tokens

The malicious npm package 'lotusbail' functions as a working WhatsApp API but contains hidden malware. It uses a malicious WebSocket wrapper to intercept authentication tokens, session keys, message history, contact lists, and media files. The package is inspired by the legitimate '@whiskeysockets/baileys' library. It hijacks the device linking process using a hard-coded pairing code, allowing persistent access to WhatsApp accounts even after package uninstallation. The malware includes anti-debugging capabilities that create infinite loop traps when debugging tools are detected. Data is encrypted and transmitted to attacker-controlled servers.