The @lendkzn/xntaabail npm package (version 7.0.0) is a malicious fork of the Baileys WhatsApp Web library. It injects a covert subscription action into the WhatsApp socket connection process, issuing an authenticated FOLLOW query to attacker-chosen WhatsApp Channel/Newsletter JIDs. The target JIDs are hidden via various obfuscation methods or fetched dynamically from attacker-controlled remote sources, allowing runtime changes without republishing the package. The malicious code leverages the installer's authenticated WhatsApp session to silently subscribe the victim's account to unwanted channels. The package does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.

The primary impact is unauthorized subscription of the victim's WhatsApp account to attacker-controlled channels, potentially leading to unwanted messages or spam. There is no direct credential theft, persistence, or remote code execution associated with this threat. The attack abuses the victim's authenticated session to increase reach for attacker channels.

No official patch or remediation is indicated for this package. Users should avoid installing or using the @lendkzn/xntaabail package version 7.0.0 and other related malicious forks of the Baileys WhatsApp Web library. Review and audit dependencies before installation, especially from untrusted sources. Remove the malicious package if already installed and monitor WhatsApp subscriptions for unauthorized channels.