This threat involves a malicious modification in the @kelvdra/baileys npm package versions 1.0.6-rc.1, 1.0.6, and 1.0.5-rc.3. The injected code hooks into the WhatsApp socket connection and issues an authenticated 'w:mex' FOLLOW query to attacker-chosen WhatsApp Channel/Newsletter JIDs, subscribing the victim's account to these channels without their knowledge. The targeted JIDs are hidden through various obfuscation methods or fetched dynamically from attacker-controlled remote sources, allowing the attacker to modify targets post-installation. This behavior leverages the victim's authenticated WhatsApp session but does not exfiltrate credentials, establish persistence, or enable remote code execution.

The impact is limited to unauthorized subscription of the victim's WhatsApp account to attacker-controlled channels, potentially leading to unwanted content delivery or spam. There is no credential theft, persistence mechanism, or arbitrary code execution involved according to the provided data.

No patch or official remediation is indicated in the provided data. Users should avoid installing or using the affected versions of the @kelvdra/baileys package (1.0.6-rc.1, 1.0.6, 1.0.5-rc.3). Since no vendor advisory or patch information is available, check for updates or official advisories from the package maintainers or npm registry. Consider auditing dependencies for malicious forks and avoid untrusted sources.