The @nyzzpedia/baileys-new npm package (version 1.0.0) is part of a large family of malicious Baileys WhatsApp Web library forks that inject a covert subscription action into the WhatsApp socket connection. Upon connecting, the injected code uses the victim's authenticated WhatsApp session to issue a FOLLOW query to attacker-chosen WhatsApp Channel/Newsletter JIDs, effectively subscribing the victim to these channels without their knowledge. The target JIDs are hidden through various obfuscation methods or fetched dynamically from attacker-controlled remote sources, enabling flexible targeting. The malicious action leverages the installer's own session and does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.

Victims unknowingly subscribe to attacker-controlled WhatsApp channels, potentially increasing the reach and subscriber count of malicious or spam channels. There is no credential theft, persistence, or remote code execution involved. The impact is limited to unauthorized channel subscriptions using the victim's authenticated session.

No official patch or remediation guidance is provided. Users should avoid installing or using the @nyzzpedia/baileys-new package version 1.0.0. Review and verify the integrity of Baileys library forks before use. Since this is a malicious package on npm, removing the package and replacing it with a trusted, official Baileys library version is recommended.