The albert-anitabaileys npm package (version 1.1.13) belongs to a family of over 100 near-identical malicious forks of the Baileys WhatsApp Web library. These forks modify the WhatsApp socket connection routine to inject a covert subscription action that, upon connection, sends an authenticated 'w:mex' FOLLOW query to attacker-chosen WhatsApp Channel/Newsletter JIDs. This action uses the installer's authenticated WhatsApp session to silently subscribe the victim's account to channels without their knowledge or consent. The target JIDs are hidden using various obfuscation techniques or fetched dynamically from attacker-controlled remote sources, allowing the attacker to change targets post-installation. The malicious code does not exfiltrate credentials, maintain persistence, or execute arbitrary remote code.

The impact is unauthorized subscription of the victim's WhatsApp account to attacker-controlled channels, potentially leading to unwanted content delivery or spam. There is no credential theft, persistence, or remote code execution involved. The attack leverages the victim's authenticated session to increase reach for attacker channels without direct compromise of the victim's device or credentials.

No official patch or remediation is currently documented for this package. Users should avoid installing or using the albert-anitabaileys package version 1.1.13 and related forks. Review dependencies for suspicious or forked Baileys libraries and remove or replace them with trusted sources. Monitor WhatsApp account subscriptions and revoke access tokens if suspicious activity is detected. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.