The @hanzofc/baileys npm package versions 7.0.0 and 7.0.1 contain malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert follow query into the WhatsApp socket connection, leveraging the installer's authenticated session. The targeted channel IDs are obfuscated or dynamically fetched, making detection difficult. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.