The arsya-baileys package (version 9.2.0) is part of a large family of malicious Baileys WhatsApp Web forks that inject a covert subscription action into the WhatsApp socket layer. Upon connection, the injected code sends an authenticated 'w:mex' FOLLOW query to attacker-chosen WhatsApp Channel/Newsletter JIDs using the installer's authenticated session, silently subscribing the victim to channels without consent. The target JIDs are obfuscated via string literals, base64, XOR, char-code arrays, or fetched dynamically from attacker-controlled remote sources, enabling runtime target changes without republishing the package. The malicious behavior leverages the victim's authenticated session but does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.

The impact is unauthorized subscription of the victim's WhatsApp account to attacker-controlled channels, potentially exposing the user to unwanted content or spam. There is no credential theft, persistence, or remote code execution involved. The attack abuses the victim's authenticated session to increase reach for attacker channels.

No official patch or remediation is currently documented. Users should avoid installing or using the arsya-baileys package version 9.2.0. Review dependencies for this package and remove or replace it with a trusted alternative. Monitor for updates from the package maintainers or npm advisories for any official fixes.