This malicious fork of the Baileys library injects covert functionality into the WhatsApp socket connection. On each WebSocket connection, it reconstructs a URL from an obfuscated char-code array to fetch a JSON list from a mutable GitHub repository branch. After a delay, it issues authenticated 'w:mex' FOLLOW queries using the installer's WhatsApp session to subscribe to newsletter IDs controlled by the attacker. The package also includes an obfuscated helper function to send similar queries to a hardcoded JID. The use of a mutable GitHub tarball dependency further allows dynamic code resolution. The upstream Baileys library does not contain this code path, indicating intentional malicious modification. The impact is limited to unauthorized actions within the WhatsApp account, without host compromise or credential theft.

The malicious code abuses the installer's authenticated WhatsApp session to perform unauthorized follow actions on behalf of the user, leading to loss of control over their WhatsApp account interactions. There is no evidence of credential exfiltration, persistence mechanisms, or remote code execution on the host machine. The threat is confined to the WhatsApp account level, potentially enabling the attacker to manipulate the victim's WhatsApp contacts or subscriptions.

No official patch or fix is currently documented for this malicious package version. Users should avoid using the @fyxzpediaa/baileys package version 8.1.2 and verify the integrity and source of Baileys library dependencies. Replace this malicious fork with the official Baileys package from trusted sources. Audit dependencies for mutable GitHub tarball references and avoid installing packages with such mutable dependencies. Monitor WhatsApp account activity for unauthorized actions and revoke session tokens if suspicious behavior is detected.