The @jojoxyz/condemnedforce-baileys npm package (version 2.3.0) belongs to a family of over 100 near-identical malicious forks of the Baileys WhatsApp Web library. These forks modify the socket connection routine to issue an authenticated 'w:mex' FOLLOW query after connecting, subscribing the victim's WhatsApp account to attacker-chosen channels without their knowledge. The targeted channel JIDs are hidden using obfuscation techniques such as base64 encoding, XOR, or runtime reconstruction, or fetched dynamically from attacker-controlled remote sources. The attack leverages the installer's authenticated WhatsApp session to increase subscribers for attacker channels but does not steal credentials or execute arbitrary code.

The malicious package causes the victim's WhatsApp account to be silently subscribed to attacker-controlled channels, potentially exposing the user to unwanted content or spam. It does not compromise credentials, establish persistence, or allow remote code execution, limiting the impact to unauthorized channel subscriptions.

No official patch or remediation is currently documented for this package. Users should avoid installing or using the @jojoxyz/condemnedforce-baileys package version 2.3.0 and related malicious forks. Since this is a client-side malicious package, removing the package and reinstalling a legitimate version of the Baileys library is recommended. Monitor for suspicious channel subscriptions in WhatsApp and unsubscribe from unknown channels.