The yonzoffic-baileys package (version 8.6.90) is part of a large family of over 100 near-identical malicious forks of the Baileys WhatsApp Web library. These forks inject a covert channel-subscription action into the WhatsApp socket layer. Upon connection, the injected code issues an authenticated 'w:mex' FOLLOW query using the installer's own WhatsApp session to silently subscribe the victim's account to attacker-chosen WhatsApp Channel/Newsletter JIDs. The target JIDs are hidden using obfuscation techniques such as base64 encoding, XOR, or runtime reconstruction, or fetched dynamically from attacker-controlled remote sources. The malicious action abuses the authenticated session to gain subscribers for attacker channels but does not exfiltrate credentials, maintain persistence, or execute arbitrary remote code.

The impact is limited to unauthorized subscription of the victim's WhatsApp account to attacker-controlled channels or newsletters. This could lead to spam, unwanted content, or potential social engineering via these channels. There is no credential theft, persistence, or remote code execution involved according to the available data.

No official patch or remediation is indicated. Users should avoid installing or using the yonzoffic-baileys package version 8.6.90. Since this is a malicious package published on npm, users should verify package authenticity and source before installation. Removal of the package and revoking WhatsApp session tokens may mitigate ongoing unauthorized subscriptions. Monitor for suspicious channel subscriptions in the WhatsApp account and unsubscribe from unknown channels.