The weavedb-base npm package version 0.45.3 includes a preinstall hook that runs a 976KB packed Linux ELF binary with capabilities including network communication, process tracing, and kernel rootkit functionality. This binary is unrelated to the package's advertised purpose and executes unconditionally during npm install without integrity checks. The malware, part of the IronWorm campaign, steals credentials for cloud providers, databases, source control, package registries, AI tools, and cryptocurrency wallets (notably injecting malicious hooks into the Exodus wallet). It also exhibits worm-like behavior by stealing GitHub and npm credentials to propagate further and uses an eBPF-based kernel rootkit to hide on Linux systems.

Any system that installs weavedb-base version 0.45.3 on Linux is at high risk of full compromise. The malicious binary executes with the installer's privileges, potentially exposing all stored secrets and keys. The malware can steal sensitive credentials, compromise developer environments, and propagate by pushing malicious code to repositories and publishing trojanized packages. The presence of a kernel rootkit means detection and removal may be difficult, and full system compromise is likely.

No official patch or fix is currently documented for this malicious package version. Immediate removal of the package is recommended. Systems with this package installed should be considered fully compromised; all secrets and keys must be rotated from a separate, trusted environment. Due to the kernel rootkit and worm-like behavior, a full system rebuild may be necessary to ensure complete remediation.