The @erlanzz/baileys npm package version 1.0.0 is a malicious fork of the Baileys WhatsApp Web library that covertly uses the installer's authenticated WhatsApp session to subscribe the account to specific WhatsApp Channels without user consent. This behavior inflates the publisher's channel subscribers by sending WhatsApp FOLLOW queries to predefined channel JIDs. The malicious code runs when an application creates a WhatsApp socket with the library and does not send credentials off-host or persist beyond runtime.