The @bellaxchuu/belbails package (version 1.0.1) is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject a covert subscription action into the WhatsApp socket layer that, upon connection, issues an authenticated 'w:mex' FOLLOW query to attacker-chosen WhatsApp Channel/Newsletter JIDs. The victim's own authenticated WhatsApp session is used to silently subscribe their account to these channels without consent. The target JIDs are obfuscated using various techniques or dynamically fetched from attacker-controlled remote sources, allowing the attacker to change targets post-installation. The malicious behavior is limited to this subscription action and does not include credential theft, persistence, or arbitrary code execution.

The impact is unauthorized subscription of the victim's WhatsApp account to attacker-controlled channels, potentially leading to unwanted content delivery or spam. There is no credential theft, persistence, or remote code execution involved. The victim's WhatsApp session is abused to increase reach for attacker channels without their knowledge.

No official patch or remediation is currently documented for this package. Users should avoid installing or using the @bellaxchuu/belbails package version 1.0.1. Since this is a malicious package published on npm, removing it from projects and replacing it with a legitimate, verified library is recommended. Monitor for updates from the package maintainers or npm advisories for any remediation announcements. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.