The @saazkira/baileys npm package versions 2.1.6 through 2.1.9 contain malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert subscription action into the WhatsApp socket layer using the installer's authenticated session. The malicious code does not steal credentials, establish persistence, or execute arbitrary remote code.