The @nyzzpediaa/baileys-new npm package is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code into the WhatsApp socket layer that issues an authenticated 'w:mex' FOLLOW query upon connection, subscribing the victim's WhatsApp account to attacker-chosen channels without their knowledge. The targeted channel JIDs are hidden using various obfuscation techniques or fetched dynamically from attacker-controlled remote sources, enabling flexible targeting. The attack leverages the installer's own authenticated WhatsApp session but does not exfiltrate credentials, establish persistence, or allow remote code execution.

The impact is unauthorized subscription of the victim's WhatsApp account to attacker-controlled channels, which could lead to unwanted content delivery or spam. There is no credential theft, persistence, or arbitrary code execution involved. The attack abuses the victim's authenticated session to increase reach for attacker channels.

No official patch or remediation is currently documented for this malicious package. Users should avoid installing or using the @nyzzpediaa/baileys-new package and its known affected versions. Review dependencies carefully and prefer official or trusted sources for WhatsApp Web libraries. Monitor for suspicious channel subscriptions in WhatsApp accounts and remove unauthorized subscriptions manually.