The spencer-baileys package (npm, version 1.0.4) is part of a large family of over 100 near-identical malicious forks of the Baileys WhatsApp Web library. These forks inject a covert subscription action into the WhatsApp socket connection process. Upon connection, the injected code sends an authenticated 'w:mex' FOLLOW query to attacker-chosen WhatsApp Channel/Newsletter JIDs, subscribing the victim's account without their knowledge. The target JIDs are hidden using various obfuscation techniques such as base64 encoding, XOR, or runtime reconstruction, or are fetched dynamically from attacker-controlled remote sources. The attack leverages the installer's authenticated WhatsApp session to increase subscribers for attacker channels but does not exfiltrate credentials or execute arbitrary remote code.

The primary impact is unauthorized subscription of the victim's WhatsApp account to attacker-controlled channels, potentially leading to unwanted messages or spam. There is no credential theft, persistence mechanism, or remote code execution involved. The attack abuses the victim's authenticated session to propagate subscriptions, which could affect user privacy and trust.

No official patch or remediation is currently documented. Users should avoid installing or using the spencer-baileys package version 1.0.4. Review dependencies carefully and verify package authenticity before installation. Monitor for suspicious subscriptions on WhatsApp accounts and remove any unauthorized channel subscriptions. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.