Malicious code in @fazzcodestudio/wa-web (npm)

The @fazzcodestudio/wa-web npm package, a fork of the Baileys WhatsApp Web library, includes code that automatically subscribes the user's authenticated WhatsApp account to specific WhatsApp Channels controlled by the publisher. This is done by sending a raw WhatsApp 'w:mex' FOLLOW query with a hardcoded channel JID shortly after the connection is established. The feature is enabled by default via the 'autoFollowNewsletterOnConnect' setting, which is undocumented and must be manually disabled to prevent this behavior. Static analysis found no evidence of credential exfiltration or install-time payloads, and the malicious action occurs only when the WhatsApp socket is created. The affected versions are 0.3.0 and 0.3.1.

The malicious code causes the victim's WhatsApp account to be covertly subscribed to channels chosen by the attacker, inflating subscriber counts without user knowledge or consent. While no credentials or session keys are sent off-host, this unauthorized use of the account violates user trust and could lead to reputational damage or unwanted content delivery. The package's presence indicates a compromised environment, and all secrets and keys on the affected system should be considered at risk.

No official patch or fix is available. Users should immediately remove the @fazzcodestudio/wa-web package from their systems. Because the package grants the publisher covert control over the WhatsApp session, it is recommended to rotate all secrets and keys stored on the affected computer from a different, trusted device. Users should also audit their environment for additional compromise. To prevent this issue, avoid using untrusted forks of libraries and verify package integrity before installation.