@trashcore/baileys is a malicious fork of the Baileys WhatsApp Web library that silently subscribes the installer's WhatsApp account to specific WhatsApp Channels without user consent. It achieves this by sending follow queries using the victim's authenticated session. The package also depends on an external GitHub repository without version pinning or integrity checks, allowing arbitrary code execution during installation.