The noxleys npm package, a fork of the Baileys WhatsApp library, contains malicious code that automatically follows and mutes WhatsApp channels controlled by the package author without user consent. This behavior is triggered on every WhatsApp connection update when the connection opens, after a 30-second delay, by fetching a mutable list of channel IDs from an author-controlled GitHub URL. The package does not disclose this behavior and uses the installer's authenticated WhatsApp account to perform these actions. No credential theft or environment scraping is reported, but the package effectively grants the author control over the user's WhatsApp interactions. The package versions 1.0.0 through 1.1.6 are affected.