The @wenzyx1/bails npm package is part of a large family of over 100 near-identical malicious forks of the Baileys WhatsApp Web library. These forks inject a covert subscription action into the WhatsApp socket layer that triggers an authenticated 'w:mex' FOLLOW query upon connection. This query subscribes the victim's WhatsApp account to attacker-chosen channels or newsletters without their knowledge. The targeted WhatsApp JIDs are hidden using various obfuscation methods or fetched dynamically from attacker-controlled remote sources, allowing the target list to change post-installation. The attack leverages the installer's authenticated WhatsApp session but does not exfiltrate credentials, establish persistence, or run arbitrary code remotely.

Victims unknowingly subscribe their WhatsApp accounts to attacker-controlled channels, potentially exposing them to unwanted messages or spam. The attack abuses the victim's authenticated session to increase reach for malicious channels but does not compromise account credentials or enable further remote code execution or persistence.

No official patch or remediation is currently documented. Users should avoid installing or using the affected package versions 1.0.0 and 1.0.1 of @wenzyx1/bails. Review and verify the integrity of npm packages before installation, especially forks of popular libraries. Monitor for updates or advisories from the package maintainers or npm registry regarding this issue. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.