The npm package xzvexpzcbailey is part of a large family of malicious forks of the Baileys WhatsApp Web library. These packages inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious behavior abuses the installer's own WhatsApp session but does not steal credentials, maintain persistence, or execute arbitrary code.