The npm package libsignal-node-travatiger (versions 1.0.0 and 1.0.1) contains malicious code that, upon installation, modifies a sibling trusted package's source code to persistently inject attacker-controlled behavior. This behavior abuses the installer's authenticated WhatsApp session to silently follow attacker-chosen channels, with the channel list hosted on a mutable GitHub repository allowing dynamic control by the attacker. The package impersonates a legitimate Signal Protocol library to deceive users. Installation of this package results in full system compromise, requiring immediate secret and key rotation from a clean system.