The @ikyyjee/ikyysingle npm package version 1.7.8 contains malicious code that hooks into the WhatsApp socket connection to issue authenticated FOLLOW queries subscribing the victim's WhatsApp account to attacker-controlled channels. The target channel JIDs are hidden using obfuscation or fetched dynamically from attacker-controlled sources, allowing flexible targeting. The malicious action leverages the installer's authenticated WhatsApp session to propagate subscriptions but does not exfiltrate credentials or execute remote code. This package is one of over 100 near-identical malicious forks of the Baileys library identified as of September 2026.

Victims unknowingly subscribe their WhatsApp accounts to attacker-controlled channels, potentially exposing them to unwanted content or spam. The attack abuses the victim's authenticated session but does not compromise credentials, establish persistence, or allow remote code execution. There is no direct data exfiltration or system compromise reported.

No official patch or fix is currently documented for this package. Users should avoid installing or using the @ikyyjee/ikyysingle package version 1.7.8 and related malicious forks. Review and remove any installations of this package. Monitor for suspicious WhatsApp channel subscriptions and unsubscribe from unknown channels. Since no vendor advisory or patch is available, users must rely on package removal and vigilance.