The levvleys package versions 2.1.0, 2.0.26, 2.0.25, 2.0.24, 2.0.23, 2.0.22, 2.0.21, 2.0.20, 2.0.19, 2.0.18, 2.0.17, 2.0.16, 2.0.13, 2.0.12, 2.0.11, 2.0.10, 2.0.9, 2.0.8, 2.0.6, and 2.0.4 are part of a family of malicious Baileys WhatsApp Web library forks that inject code into the WhatsApp socket layer. This code issues an authenticated FOLLOW query (w:mex) to attacker-chosen WhatsApp Channel/Newsletter JIDs using the installer's own authenticated WhatsApp session, silently subscribing the victim's account to these channels. The target JIDs are obfuscated or dynamically fetched at runtime, allowing attackers to change targets without republishing the package. The malicious action abuses the victim's session to gain subscribers but does not steal credentials, maintain persistence, or run arbitrary code.

Victims unknowingly subscribe their WhatsApp accounts to attacker-controlled channels or newsletters, potentially exposing them to unwanted content or spam. The attack leverages the victim's authenticated WhatsApp session but does not compromise credentials, establish persistence, or enable remote code execution.

No official patch or remediation is indicated in the provided data. Users should avoid installing or using affected versions of the levvleys package. Review and remove any suspicious subscriptions in WhatsApp. Monitor for updates or advisories from the package maintainers or npm regarding fixes or removals. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.