The whalibmob npm package contains malicious code that silently subscribes the installer's authenticated WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert channel-subscription action into the WhatsApp socket layer, issuing authenticated FOLLOW queries to attacker-chosen WhatsApp Channel/Newsletter JIDs. The targeted JIDs are obfuscated or dynamically fetched to evade detection. The malicious behavior does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.