The @prototypevip/baileys npm package version 0.0.3 contains malicious code that intercepts incoming WhatsApp messages and, if the bot is not tagged with a specific hardcoded owner string, uses the installer's authenticated WhatsApp session to send an unauthorized Arabic message to the installer's contacts. This behavior is hidden by base64 obfuscation and disrupts normal message handling by throwing an error.