The @fhkry/x-baileys npm package is a malicious impersonation of the @whiskeysockets/baileys library. It adds hidden functionality that triggers two side effects on any WhatsApp socket created: (1) after 120 seconds, it decodes and fetches a remote JSON containing base64-encoded newsletter IDs and silently subscribes the user's WhatsApp account to these newsletters; (2) upon connection update, it automatically accepts invites to attacker-controlled WhatsApp groups. Both the newsletter and group invite lists are remotely hosted on GitHub and can be changed by the attacker at any time. The package metadata falsely claims the original Baileys maintainer as author and uses a misleading homepage URL, confirming intent to deceive. This results in silent hijacking of the consumer's WhatsApp identity to follow attacker-chosen content and groups. The compromise extends beyond WhatsApp as the package grants attacker control over the host environment. Removal of the package alone may not fully remediate the compromise.

Any system with this package installed or running is considered fully compromised. The attacker gains the ability to silently subscribe the user's WhatsApp account to newsletters and join WhatsApp groups under the user's identity without consent. This hijacks the user's WhatsApp presence and can expose them to further social engineering or information leakage. Because the package executes code that interacts with authenticated WhatsApp sessions and can be updated remotely, the attacker maintains persistent control. Additionally, full compromise of the host system is possible, risking all stored secrets and keys. Immediate secret rotation is required from a clean environment after removal.

There is no official patch or fix available for this malicious package. The package should be immediately removed from all environments. All secrets, keys, and credentials stored on affected systems should be considered compromised and rotated immediately from a different, clean device. Due to the potential for full system compromise, a full security audit and possible system rebuild is recommended. Avoid using this package or any forks that impersonate legitimate libraries. Verify package authenticity and source before installation.