Versions 1.0.1 through 1.1.4 of the npm package jexkcode automatically follow a hard-coded WhatsApp newsletter upon opening a WhatsApp connection without user consent or configuration options. This behavior modifies the user's WhatsApp account without authorization and is unrelated to the package's stated functionality. The automatic follow action occurs silently in later versions, removing visible logs of success or failure. Installing or running this package may lead to full system compromise.