The @ostyado/baileys npm package, a fork of the Baileys WhatsApp Web library, contains injected code that modifies the socket connection routine to issue an authenticated 'w:mex' FOLLOW query on connect. This query subscribes the victim's WhatsApp account to attacker-chosen channels or newsletters, leveraging the victim's authenticated session. The targeted channel JIDs are hidden via obfuscation techniques such as base64 encoding, XOR, or runtime reconstruction, or fetched dynamically from attacker-controlled remote sources. The malicious behavior is consistent across over 100 near-identical forks, differing only in package name, JID values, and obfuscation methods. The code does not exfiltrate credentials or execute arbitrary remote code.

Victims unknowingly subscribe their WhatsApp accounts to attacker-controlled channels, potentially exposing them to unwanted content or spam. The attack leverages the victim's authenticated session but does not compromise credentials or allow remote code execution. There is no persistence or credential theft involved.

No official patch or remediation is documented for this malicious package. Users should avoid installing or using the affected versions of @ostyado/baileys (2.0.6 to 2.0.9). Remove any installations of these versions and obtain the library from trusted sources or official repositories. Monitor for suspicious WhatsApp channel subscriptions and revoke unauthorized ones manually. Since this is a malicious package, standard npm security practices such as verifying package integrity and source are recommended.