This threat involves a family of over 100 near-identical malicious forks of the Baileys WhatsApp Web library, including the @queenanya/baileys package. These forks inject code that, upon establishing a WhatsApp socket connection, issues an authenticated 'w:mex' FOLLOW query to attacker-chosen WhatsApp Channel/Newsletter JIDs. The victim's authenticated WhatsApp session is abused to silently subscribe the account to these channels. Obfuscation techniques hide the target JIDs, and some variants fetch the target list dynamically from attacker-controlled remote sources. The malicious behavior is limited to subscription abuse and does not involve credential theft, persistence, or remote code execution.

Victims unknowingly subscribe their WhatsApp accounts to attacker-controlled channels, potentially exposing them to unwanted content or spam. The attack leverages the victim's authenticated session but does not compromise credentials or allow further remote code execution. There is no indication of persistence or broader system compromise.

No official patch or remediation is currently documented. Users should avoid installing or using the affected @queenanya/baileys package versions 9.10.1, 9.7.3-beta.1, and 9.7.2. Review and verify the integrity of Baileys library packages before use. Monitor for updates or advisories from the package maintainers or npm registry for remediation guidance. Since this is a client-side library, uninstalling or replacing the malicious package with a trusted version is recommended.