The cantarella-baileys package is part of a large family of near-identical forks of the Baileys WhatsApp Web library that inject code to perform covert subscriptions to attacker-chosen WhatsApp channels. Upon connection, the injected code issues an authenticated 'w:mex' FOLLOW query using the installer's authenticated WhatsApp session to silently subscribe the victim's account to channels without their knowledge. The targeted channel JIDs are obfuscated via various encoding methods or dynamically fetched from attacker-controlled remote sources, allowing the target list to change post-installation. The malicious behavior is consistent across the family despite differences in package name and obfuscation techniques. The attack does not involve credential theft, persistence, or arbitrary code execution.

Victims unknowingly subscribe their WhatsApp accounts to attacker-controlled channels, potentially exposing them to unwanted content or spam. The attack leverages the victim's authenticated session to perform these subscriptions without exfiltrating credentials or establishing persistence. There is no indication of further compromise beyond unauthorized channel subscriptions.

No official patch or remediation is documented. Users should avoid installing or using the affected cantarella-baileys package versions 1.1.11, 1.1.12, and 1.1.13. Review installed npm packages for suspicious forks of Baileys and remove any identified malicious versions. Monitor for updates from the package maintainers or npm advisories for potential fixes.