This threat involves a family of over 100 near-identical malicious forks of the Baileys WhatsApp Web library, including the @japofc/baileys npm package versions 2.1.0 through 2.4.3. The injected code patches the WhatsApp socket connect routine to issue an authenticated 'w:mex' FOLLOW query to attacker-chosen WhatsApp Channel/Newsletter JIDs shortly after connection. The victim's own authenticated WhatsApp session is abused to silently subscribe their account to these channels. The target JIDs are hidden through various obfuscation techniques or fetched dynamically from attacker-controlled remote sources, enabling flexible targeting without republishing the package. The malicious action is limited to subscription abuse and does not involve credential theft, persistence, or arbitrary code execution.

The primary impact is unauthorized subscription of the victim's WhatsApp account to attacker-controlled channels, potentially leading to unwanted messages or spam. There is no credential theft, no persistence established, and no arbitrary remote code execution. The attack leverages the victim's authenticated session to increase reach for attacker channels.

No official patch or remediation guidance is provided in the available data. Users should avoid installing or using the affected versions of the @japofc/baileys package (2.1.0 through 2.4.3). Review and replace any usage of this package with a trusted, verified version or alternative. Monitor for updates from the package maintainers or npm advisories for any official fixes.