This threat involves a malicious fork of the Baileys WhatsApp Web library named @lendxntaa/baileys, which injects code into the WhatsApp socket connection process. Upon connection, the injected code issues an authenticated 'w:mex' FOLLOW query to attacker-chosen WhatsApp Channel/Newsletter JIDs, subscribing the victim's account to these channels without their knowledge. The target JIDs are hidden using various obfuscation methods or fetched dynamically from remote sources, allowing attackers to modify targets post-installation. The attack leverages the installer's authenticated WhatsApp session but does not exfiltrate credentials or execute arbitrary remote code. Affected versions include 9.5.0, 9.3.0, 9.1.0, 9.0.2, and 9.0.1 of the package.

The impact is unauthorized subscription of the victim's WhatsApp account to attacker-controlled channels, potentially leading to unwanted content delivery and privacy concerns. There is no credential theft, persistence, or remote code execution involved. The attack abuses the victim's authenticated session to increase reach for attacker channels.

No official patch or remediation guidance is provided in the input data. Users should avoid using the affected versions of the @lendxntaa/baileys package. Since this is a malicious fork, replacing it with the official Baileys library or verified packages is recommended. Patch status is not yet confirmed — check the vendor advisory or trusted sources for current remediation guidance.