I went through The Hacker News's September 29, 2026 report on this: 101 Malicious npm Packages Add Developers' WhatsApp Accounts to Groups Without Consent.
I am working from that public report, then saying what I take from it. If this sits near your stack, read the original and any official notice before you move.
I am writing from The Hacker News. That is the source. The framing is mine.