The @mikudeveloper/grace package contains malicious code that modifies the WhatsApp Web socket connection to issue an authenticated 'w:mex' FOLLOW query after connection. This query subscribes the victim's WhatsApp account to attacker-chosen channels or newsletters without user knowledge or consent. The target channel JIDs are concealed using various obfuscation methods or dynamically retrieved from attacker-controlled remote sources, allowing the attacker to change targets post-installation. This behavior abuses the victim's own authenticated WhatsApp session to increase subscribers for attacker channels. The package versions affected are 2.0.1, 1.0.21, and 1.0.20. The malicious action does not involve credential theft, persistence mechanisms, or arbitrary code execution.

Victims unknowingly subscribe their WhatsApp accounts to attacker-controlled channels, potentially exposing them to unwanted content or spam. The attack leverages the victim's authenticated session but does not compromise credentials or allow remote code execution. There is no persistence or direct data exfiltration reported.

No official patch or remediation is documented for this malicious package. Users should avoid installing or using the affected versions of @mikudeveloper/grace (2.0.1, 1.0.21, 1.0.20). Remove these versions if present and monitor for suspicious WhatsApp channel subscriptions. Consider using trusted package sources and verifying package integrity before installation.