This threat involves a family of over 100 near-identical malicious forks of the Baileys WhatsApp Web library, including the @saazkira/baileys npm package versions 2.1.6 to 2.1.9. The injected code patches the WhatsApp socket connect routine to issue an authenticated 'w:mex' FOLLOW query to attacker-controlled WhatsApp Channel JIDs shortly after connection. The victim's authenticated WhatsApp session is abused to silently subscribe their account to these channels. The target JIDs are hidden via obfuscation methods such as base64 encoding, XOR, or runtime reconstruction, or fetched dynamically from attacker-controlled remote sources. The malicious action is limited to subscription abuse and does not involve credential theft, persistence, or arbitrary code execution.

Victims unknowingly subscribe their WhatsApp accounts to attacker-controlled channels or newsletters, potentially exposing them to unwanted content or spam. The attack leverages the victim's authenticated session but does not compromise credentials or allow further remote code execution or persistence. The impact is primarily unauthorized subscription and potential privacy or spam concerns.

No official patch or remediation guidance is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid installing or using the affected versions of the @saazkira/baileys package (2.1.6 to 2.1.9) and verify the integrity of their dependencies. Consider using trusted package sources and scanning for malicious code in dependencies.