The npm package @astracode/byles-new contains malicious code that silently subscribes a victim's authenticated WhatsApp account to attacker-controlled channels without consent. This is done by injecting a covert channel-subscription action into the WhatsApp socket layer, issuing an authenticated FOLLOW query upon connection. The targeted WhatsApp channel IDs are obfuscated or dynamically fetched, allowing attackers to modify targets after installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.