The @fhkry/baileys npm package (version 8.0.13) is a malicious fork of the Baileys WhatsApp Web library. It silently performs unauthorized WhatsApp newsletter subscription actions on the user's authenticated WhatsApp account by fetching a remote, mutable list controlled by the attacker. The malicious behavior is obfuscated in the source code to evade detection. Any application using this package and calling makeWASocket() unknowingly acts as a node amplifying the attacker's newsletter subscriptions. The package compromises the host system, potentially exposing all stored secrets and keys.