The @xayz/baileys npm package, a fork of the Baileys WhatsApp Web library, contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert FOLLOW query into the WhatsApp socket connection using the installer's authenticated session. The target channels are obfuscated using various techniques and may be dynamically fetched from attacker-controlled sources. The malicious code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.