The npm package @mikudeveloper/grace versions 2.0.1, 1.0.21, and 1.0.20 contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This malicious behavior leverages the victim's authenticated WhatsApp session. The injected code does not steal credentials, maintain persistence, or execute arbitrary remote code, but it enables stealthy and flexible subscription to hidden or dynamically fetched channels.