The @ikanngeming/ikannbail npm package versions 1.0.2 to 1.0.7 contains malicious code that modifies the WhatsApp Web socket connection to issue an authenticated 'w:mex' FOLLOW query to attacker-chosen WhatsApp Channel/Newsletter JIDs. This covert subscription action uses the victim's own authenticated WhatsApp session to silently subscribe them to channels controlled by the attacker. The target JIDs are obfuscated or dynamically retrieved at runtime, allowing attackers to change targets without republishing the package. The malicious behavior is consistent across a family of over 100 near-identical forks of the Baileys library, differing mainly in obfuscation and delivery methods. The code does not steal credentials, maintain persistence, or execute arbitrary remote code.

Victims unknowingly subscribe their WhatsApp accounts to attacker-controlled channels, potentially exposing them to unwanted content or spam. The attack leverages the victim's authenticated session but does not compromise credentials or enable remote code execution. There is no indication of persistence or broader system compromise from this behavior.

No official patch or remediation is currently documented for this package. Users should avoid installing or using the affected versions (1.0.2 through 1.0.7) of @ikanngeming/ikannbail. Review dependencies for forks of the Baileys WhatsApp Web library and replace them with trusted, verified packages. Monitor for updates from the package maintainers or security advisories for any official fixes.