The npm package 'bungoma' versions 1.0.0, 1.0.1, and 1.1.0 are malicious forks of the Baileys WhatsApp Web library. These versions contain code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched, enabling attackers to change subscription targets after installation. The malicious code abuses the installer's authenticated session but does not steal credentials, maintain persistence, or execute arbitrary code.