The focashi npm package version 1.1.0 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The malicious subscription targets are obfuscated or dynamically fetched, and the attack leverages the victim's own WhatsApp session. The code does not steal credentials, maintain persistence, or execute arbitrary remote code.