The @bottino/baileys package is part of a large family of near-identical malicious forks of the Baileys WhatsApp Web library. These forks inject code into the WhatsApp socket connection routine that, shortly after connecting, sends an authenticated 'w:mex' FOLLOW query to attacker-chosen WhatsApp Channel/Newsletter JIDs. This action uses the installer's authenticated WhatsApp session to silently subscribe the victim's account to channels without their knowledge. The targeted JIDs are hidden using various obfuscation methods or fetched dynamically from attacker-controlled remote sources. The malicious behavior is consistent across all identified forks, though package names and delivery methods vary. The code does not steal credentials, maintain persistence, or allow remote code execution.

Victims unknowingly subscribe their WhatsApp accounts to attacker-controlled channels, potentially exposing them to unwanted content or spam. The attack leverages the victim's authenticated session but does not compromise credentials or system integrity. There is no indication of further malicious actions such as data exfiltration or remote code execution.

No official patch or remediation guidance is provided in the available data. Users should avoid installing or using the affected versions of the @bottino/baileys package listed. Verify package integrity and source before installation. Monitor for updates from the package maintainers or security advisories for potential fixes. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for current remediation guidance.