The @queenanya/baileys npm package versions 9.10.1, 9.7.3-beta.1, and 9.7.2 contain malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert FOLLOW query into the WhatsApp socket connection using the installer's authenticated session. The targeted channel identifiers are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code.