The whalibmob package, part of a large family of near-identical Baileys WhatsApp Web library forks, injects code that modifies the WhatsApp socket connection routine. Upon connection, it issues an authenticated 'w:mex' FOLLOW query using the installer's own WhatsApp session to subscribe the victim's account to attacker-controlled channels. The targeted channel JIDs are hidden via obfuscation or fetched dynamically from attacker-controlled hosts, allowing runtime modification of targets without republishing the package. This behavior abuses the installer's authenticated session to increase reach for attacker channels but does not involve credential theft, persistence, or arbitrary code execution.

Victims unknowingly subscribe their WhatsApp accounts to attacker-controlled channels or newsletters, potentially exposing them to unwanted content or spam. The attack leverages the victim's authenticated session to perform these subscriptions silently. There is no direct credential theft, remote code execution, or persistence established by this malicious code.

No official patch or remediation is currently documented. Users should avoid installing or updating to the affected whalibmob package versions listed. Review and verify package sources before installation. Monitor for suspicious WhatsApp channel subscriptions and remove any unauthorized subscriptions. Since this is a malicious package behavior rather than a traditional vulnerability, remediation depends on avoiding use of the compromised package versions.