@mrlegendbot/baileys versions 1.2.4 and 1.2.5 contain malicious code that causes the victim's WhatsApp account to automatically follow attacker-chosen newsletter channels. This behavior is triggered by a hidden function that fetches a list of channel IDs from a remote GitHub repository and follows them at regular intervals without user consent. The malicious code is not present in the upstream library and can be updated dynamically by the attacker without releasing a new package version.