The @bellaxchuu/privatebails package (version 1.4.1) is one of over 100 near-identical malicious forks of the Baileys WhatsApp Web library. These forks modify the socket connection routine to issue an authenticated 'w:mex' FOLLOW query shortly after connecting, subscribing the victim's WhatsApp account to attacker-chosen channels. The target channel JIDs are hidden using obfuscation techniques such as base64 encoding, XOR, or runtime reconstruction, or are dynamically fetched from attacker-controlled remote sources. The malicious code leverages the installer's authenticated WhatsApp session to silently subscribe the user to channels, increasing attacker reach. The code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.

The impact is unauthorized subscription of the victim's WhatsApp account to attacker-controlled channels, potentially leading to unwanted content delivery or spam. There is no credential theft, no persistence mechanism, and no arbitrary code execution involved. The attack leverages the victim's authenticated session to amplify attacker channel subscriptions.

No official patch or remediation guidance is provided in the available data. Users should avoid installing or using the affected package version 1.4.1. Since this is a malicious package, removing it and replacing it with a legitimate, verified library is recommended. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.