The @lendxntaa/baileys npm package, a fork of the Baileys WhatsApp Web library, contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This action is performed by injecting a covert subscription into the WhatsApp socket layer using the victim's authenticated session. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code. The targeted channels are obfuscated or dynamically fetched to avoid detection.