The npm package @ubedsockets/baileys is a trojanized fork of the legitimate Baileys WhatsApp library. It contains malicious code that automatically subscribes victims to attacker-controlled WhatsApp newsletter channels upon connection. The package uses a mutable off-registry dependency for its cryptographic component, allowing remote code execution during installation. Additionally, it includes an IP-locked kill switch that terminates the host process unless the installer's IP matches specific hardcoded addresses. All published versions of this package are malicious.