The npm package @fhkryxv/baileys versions 1.0.1 and 1.0.3 contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This action is performed by injecting a covert subscription command into the WhatsApp socket layer using the installer's authenticated session. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.