The 'cwao-units' npm package version 0.8.3 includes a preinstall lifecycle script that runs a 976,568-byte Linux x86-64 ELF binary with no source or build configuration, indicating a malicious payload. This binary contains network, tracing, and cryptographic capabilities and is executed before the package is loaded, evading inspection. The payload is a Rust-built infostealer targeting developer environments by harvesting credentials for cloud providers, databases, source control, package registries, AI tools, and cryptocurrency wallets (notably injecting malicious hooks into the Exodus wallet). It also uses an eBPF-based kernel rootkit to hide processes and network activity on Linux systems. The malware exhibits worm-like propagation by stealing GitHub and npm credentials to push malicious updates and trojanized packages. This package is part of the IronWorm campaign and fully compromises affected systems.

Systems with 'cwao-units' version 0.8.3 installed are fully compromised. The malware steals sensitive credentials and secrets related to cloud services, development tools, and cryptocurrency wallets. It can maintain stealth via kernel rootkit techniques and propagate by compromising developer repositories and npm packages. This results in a complete loss of system integrity and confidentiality, requiring immediate secret rotation and system remediation.

No official patch or fix is available for this malicious package. The package should be immediately removed from all systems. All secrets, keys, and credentials stored on affected systems must be rotated from a separate, uncompromised device. Because the malware includes rootkit capabilities and worm-like propagation, full system reimaging or replacement is recommended to ensure complete removal. Monitor for any signs of compromise and avoid installing this package or any related trojanized packages.