The npm package @noxleyss/baileys version 1.1.10 is part of a family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The subscription targets are obfuscated or dynamically fetched, making detection difficult. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.