The @rennnpm/baileys package (version 1.0.0) is part of a large family of over 100 near-identical malicious forks of the Baileys WhatsApp Web library. These forks inject a covert channel-subscription action into the WhatsApp socket layer. Upon connection, the injected code issues an authenticated 'w:mex' FOLLOW query with a specific query_id against attacker-chosen WhatsApp Channel/Newsletter JIDs, subscribing the victim's account to these channels silently. The target JIDs are hidden using obfuscation techniques such as plain strings, base64 encoding, base64+XOR, char-code arrays, or fetched dynamically from attacker-controlled remote sources. The mechanism relies on wrapping or patching the socket-connect routine to trigger the FOLLOW query shortly after connection. The malicious action leverages the installer's authenticated WhatsApp session but does not steal credentials, maintain persistence, or run arbitrary code remotely.

The impact is unauthorized subscription of the victim's WhatsApp account to attacker-controlled channels, potentially leading to unwanted content delivery or spam. There is no credential theft, persistence, or arbitrary code execution involved. This misuse of the authenticated session could affect user privacy and trust but does not directly compromise account credentials or device integrity.

No official patch or remediation is currently documented. Users should avoid installing or using the @rennnpm/baileys package version 1.0.0. Review and verify the integrity and source of Baileys library forks before use. Since this is a malicious package on npm, removing the package and replacing it with the official Baileys library from trusted sources is recommended. Monitor for updates from the official Baileys project or npm advisories for further guidance.