Malicious code in wao (npm)
The wao npm package versions 0.41.2, 0.41.3, and 0.41.4 contain a malicious preinstall lifecycle hook that executes a disguised native Linux ELF binary. This binary acts as a credential-harvesting implant with capabilities including eBPF and ptrace usage, outbound HTTPS exfiltration, and a secondary payload channel. The malware targets developer environments, stealing credentials for cloud providers, source control, package registries, AI tools, and cryptocurrency wallets. It also exhibits worm-like behavior by pushing malicious updates to repositories and publishing trojanized packages. The infection may result in full system compromise, and removing the package does not guarantee eradication of the malware.
AI Analysis
Technical Summary
The wao npm package was compromised as part of the IronWorm campaign. Its package.json declares a preinstall script that executes a 976KB Linux ELF binary disguised as a TypeScript file (deps.ts). This binary is a Rust-built infostealer implant that harvests credentials related to cloud services, databases, source control, package registries, AI developer tools, and cryptocurrency wallets, including injecting malicious JavaScript into the Exodus wallet. It uses eBPF-based kernel rootkit techniques to hide its presence on Linux systems and exhibits worm-like propagation by stealing GitHub and NPM credentials to push malicious updates and publish trojanized packages. The 0.41.2 tarball also contains an undeclared large secondary payload (wao-0.41.1.tgz), enabling further malicious activity. This behavior results in full compromise of any system with the package installed or running.
Potential Impact
Systems with the affected wao package versions installed are likely fully compromised. The malware harvests a wide range of sensitive credentials, including cloud, database, source control, package registry, AI tool, and cryptocurrency wallet credentials. It uses kernel rootkit techniques to evade detection and can propagate by pushing malicious updates to repositories and publishing trojanized packages. Secrets and keys stored on infected machines should be considered compromised and rotated immediately. Removing the package alone does not guarantee removal of all malicious components or persistence mechanisms.
Mitigation Recommendations
No official patch or fix is currently available. Users should immediately remove the affected wao package versions (=0.41.2, =0.41.3, =0.41.4) from their systems. Due to the high likelihood of full system compromise, all secrets, credentials, and keys stored on the affected machines must be rotated from a separate, trusted environment. Comprehensive incident response and forensic analysis are recommended to identify and eradicate any persistent malware. Monitor for any suspicious activity related to repository updates or package publishing. Verify the integrity of developer environments before reinstalling any packages.
Malicious code in wao (npm)
Description
The wao npm package versions 0.41.2, 0.41.3, and 0.41.4 contain a malicious preinstall lifecycle hook that executes a disguised native Linux ELF binary. This binary acts as a credential-harvesting implant with capabilities including eBPF and ptrace usage, outbound HTTPS exfiltration, and a secondary payload channel. The malware targets developer environments, stealing credentials for cloud providers, source control, package registries, AI tools, and cryptocurrency wallets. It also exhibits worm-like behavior by pushing malicious updates to repositories and publishing trojanized packages. The infection may result in full system compromise, and removing the package does not guarantee eradication of the malware.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The wao npm package was compromised as part of the IronWorm campaign. Its package.json declares a preinstall script that executes a 976KB Linux ELF binary disguised as a TypeScript file (deps.ts). This binary is a Rust-built infostealer implant that harvests credentials related to cloud services, databases, source control, package registries, AI developer tools, and cryptocurrency wallets, including injecting malicious JavaScript into the Exodus wallet. It uses eBPF-based kernel rootkit techniques to hide its presence on Linux systems and exhibits worm-like propagation by stealing GitHub and NPM credentials to push malicious updates and publish trojanized packages. The 0.41.2 tarball also contains an undeclared large secondary payload (wao-0.41.1.tgz), enabling further malicious activity. This behavior results in full compromise of any system with the package installed or running.
Potential Impact
Systems with the affected wao package versions installed are likely fully compromised. The malware harvests a wide range of sensitive credentials, including cloud, database, source control, package registry, AI tool, and cryptocurrency wallet credentials. It uses kernel rootkit techniques to evade detection and can propagate by pushing malicious updates to repositories and publishing trojanized packages. Secrets and keys stored on infected machines should be considered compromised and rotated immediately. Removing the package alone does not guarantee removal of all malicious components or persistence mechanisms.
Mitigation Recommendations
No official patch or fix is currently available. Users should immediately remove the affected wao package versions (=0.41.2, =0.41.3, =0.41.4) from their systems. Due to the high likelihood of full system compromise, all secrets, credentials, and keys stored on the affected machines must be rotated from a separate, trusted environment. Comprehensive incident response and forensic analysis are recommended to identify and eradicate any persistent malware. Monitor for any suspicious activity related to repository updates or package publishing. Verify the integrity of developer environments before reinstalling any packages.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-4711
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-hr8w-cxp4-33p7"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a3ef7b927e9c79719ffc40b
Added to database: 06/26/2026, 22:05:45 UTC
Last enriched: 06/26/2026, 22:32:07 UTC
Last updated: 07/20/2026, 07:52:49 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.