The @fhkryxv/baileys-new npm package (version 0.3.22) is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject a covert subscription action into the WhatsApp socket layer, which on connection issues an authenticated 'w:mex' FOLLOW query to attacker-chosen WhatsApp Channel/Newsletter JIDs. The subscription uses the installer's authenticated WhatsApp session to silently subscribe the victim's account to channels without their knowledge. The target JIDs are hidden via obfuscation techniques or dynamically fetched from attacker-controlled remote sources, enabling flexible targeting. The malicious code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.

Victims unknowingly subscribe their WhatsApp accounts to attacker-controlled channels, potentially exposing them to unwanted content or spam. The attack leverages the victim's authenticated session but does not compromise credentials or allow remote code execution. There is no persistence or credential theft involved.

No official patch or remediation is currently documented. Users should avoid installing or using the @fhkryxv/baileys-new package version 0.3.22. Since this is a malicious package, removing it from projects and replacing it with the official Baileys library or verified forks is recommended. Monitor for updates from the package maintainers or npm advisories for further guidance. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.