The @fhkry/baileys package at version 8.0.13 contains malicious code that, on each WebSocket connection, fetches a remote JSON list from an obfuscated URL controlled by the attacker. It then issues WhatsApp newsletter subscription mutations against the authenticated user's session, effectively hijacking the account to follow attacker-chosen newsletters. The code uses obfuscation techniques such as String.fromCharCode and base64+XOR encoding to hide its true intent. The remote list is mutable without integrity checks, allowing the attacker to change the newsletters dynamically. The default pairing code and author attribution confirm single-author malicious intent. This package compromises any system it is installed on, potentially exposing all secrets and keys stored on that system.

Systems with this package installed are fully compromised. The attacker gains the ability to silently manipulate the victim's WhatsApp account to subscribe to newsletters controlled by the attacker, potentially enabling further abuse or information gathering. Because the package runs code fetched from a mutable remote source without integrity verification, the attacker can change payloads at will. The compromise extends to the host system, risking exposure of stored secrets and keys. Removal of the package alone may not fully restore system integrity due to potential persistence of malicious artifacts.

No official patch or fix is available for this malicious package. The recommended mitigation is immediate removal of the @fhkry/baileys package version 8.0.13 from all systems. All secrets and keys stored on affected systems should be rotated from a clean, uncompromised environment. Users should avoid using this package and verify the authenticity of Baileys library sources. Due to the full compromise risk, a thorough system integrity check and potential rebuild is advised.