The yonzofficial npm package versions 2.1.0 to 2.1.3 contain malicious code that modifies the WhatsApp Web socket connection to issue authenticated FOLLOW queries to attacker-chosen WhatsApp Channel/Newsletter JIDs. This covert subscription action uses the installer's authenticated WhatsApp session to silently subscribe the victim to channels controlled by the attacker. The targeted JIDs are hidden via obfuscation methods such as base64 encoding, XOR, or runtime reconstruction, or are fetched dynamically from attacker-controlled remote sources. This behavior is consistent across a large family of over 100 near-identical Baileys library forks. The malicious action does not exfiltrate credentials, establish persistence, or enable remote code execution.

Victims unknowingly subscribe their WhatsApp accounts to attacker-controlled channels, potentially exposing them to unwanted content or spam. The attack leverages the victim's authenticated session to perform these subscriptions without credential theft or further compromise. There is no indication of credential exfiltration, persistence, or remote code execution from this malicious code.

No official patch or remediation is currently documented for the yonzofficial package. Users should avoid installing or using versions 2.1.0 through 2.1.3 of yonzofficial. Review and replace any dependencies that use this package with trusted alternatives. Monitor for suspicious WhatsApp channel subscriptions and remove unauthorized subscriptions manually. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.