The @ikyyjee/ikyysinggle npm package version 1.7.7 contains malicious code that modifies the WhatsApp Web socket connection to issue an authenticated 'w:mex' FOLLOW query. This query subscribes the victim's WhatsApp account to attacker-chosen channels or newsletters without their knowledge. The target channel JIDs are hidden using various obfuscation methods or fetched dynamically from attacker-controlled remote sources, allowing the attacker to change targets post-installation. The underlying mechanism is consistent across a family of over 100 similar malicious forks. The attack leverages the victim's own authenticated session but does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.

The impact is unauthorized subscription of the victim's WhatsApp account to attacker-controlled channels, potentially leading to unwanted messages or spam. There is no credential theft, persistence, or remote code execution involved. The attack leverages the victim's authenticated session to increase reach for attacker channels.

No official patch or remediation is currently documented for this package. Users should avoid installing or using the affected version 1.7.7 of @ikyyjee/ikyysinggle. Review dependencies for malicious forks of Baileys WhatsApp Web library and remove any suspicious packages. Monitor for updates from the package maintainers or npm advisories for potential fixes.