The dzyclutch npm package, a fork of the Baileys WhatsApp library, contains malicious code that covertly subscribes the installer's WhatsApp account to author-controlled newsletter channels. This subscription occurs 30 seconds after connection and is hidden from the user by muting the channels. The list of subscribed channels is remotely controlled via a mutable GitHub raw URL, allowing dynamic changes without package updates. No credential theft, remote code execution, or data exfiltration outside WhatsApp is observed, but the installer's WhatsApp identity is misused to amplify the author's channel reach.