The 'anuaja' npm package (versions 1.0.0, 1.1.0, 1.1.1) belongs to a family of over 100 near-identical malicious forks of the Baileys WhatsApp Web library. These forks inject a covert subscription action into the WhatsApp socket layer that, upon connection, issues an authenticated 'w:mex' FOLLOW query to attacker-chosen WhatsApp Channel/Newsletter JIDs. This action silently subscribes the victim's WhatsApp account to these channels using the victim's authenticated session. The target JIDs are obfuscated via multiple techniques or dynamically fetched from attacker-controlled remote sources, allowing runtime changes without republishing the npm package. The malicious behavior is consistent across the family, involving a patched socket-connect routine that triggers the FOLLOW query shortly after connection. The attack does not involve credential theft, persistence mechanisms, or arbitrary code execution.

Victims unknowingly subscribe their WhatsApp accounts to attacker-controlled channels or newsletters, potentially exposing them to unwanted content or spam. The attack leverages the victim's authenticated WhatsApp session to perform these subscriptions silently. There is no direct credential compromise, persistence, or remote code execution involved.

No official patch or remediation is currently documented. Users should avoid installing or using the affected 'anuaja' package versions 1.0.0, 1.1.0, and 1.1.1. Review and audit dependencies for forks of the Baileys WhatsApp Web library, especially those with obfuscated or dynamic code fetching. Monitor for suspicious subscriptions in WhatsApp accounts and remove unauthorized channel subscriptions manually. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.