The baileys-xbats package is part of a large family of over 100 near-identical malicious forks of the Baileys WhatsApp Web library. These forks inject covert subscription actions into the WhatsApp socket layer, issuing authenticated FOLLOW queries to attacker-chosen WhatsApp Channel/Newsletter JIDs using the victim's authenticated session. The target JIDs are hidden via obfuscation or fetched dynamically from attacker-controlled sources, allowing runtime changes without republishing the package. The injected code activates shortly after socket connection, silently subscribing the victim's account to unwanted channels. The malicious action leverages the installer's authenticated session but does not exfiltrate credentials, establish persistence, or execute arbitrary remote code. Affected versions are 1.0.0, 1.0.1, 1.0.2, and 1.0.3.

Victims unknowingly subscribe their WhatsApp accounts to attacker-controlled channels, potentially exposing them to unwanted content or spam. The attack abuses the victim's authenticated session to increase reach for malicious channels but does not compromise credentials or allow remote code execution. There is no persistence or credential theft involved.

No official patch or remediation is indicated in the provided data. Users should avoid installing or using the affected baileys-xbats package versions (1.0.0 through 1.0.3). Review and remove any subscriptions to unknown WhatsApp channels. Monitor for updates from the package maintainers or trusted sources for any official fixes or advisories. Since this is a malicious package, prefer using the official Baileys library or verified forks.