The @badzz88/baileys npm package, a fork of the Baileys WhatsApp Web library, contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert FOLLOW query into the WhatsApp socket connection using the installer's authenticated session. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code. The targeted channel IDs are obfuscated or fetched remotely, allowing attackers to change targets after installation.