The weavedb-client npm package version 0.45.3 was compromised as part of the IronWorm campaign. It includes a preinstall hook that executes a large UPX-packed Linux x86-64 ELF binary, which is a Rust-built infostealer. This binary harvests a wide range of developer credentials including SSH/PuTTY private keys, GitHub and OAuth tokens, environment variables, and cryptocurrency wallet secrets by injecting malicious JavaScript into the Exodus wallet. The malware exhibits worm-like propagation by stealing credentials to push malicious updates and publish trojanized packages. Additionally, it uses an eBPF-based kernel rootkit to hide its processes and network activity on Linux systems. The presence of this package on a system indicates a high likelihood of full compromise.

Installation of the affected package version results in execution of a malicious native binary that steals sensitive credentials and tokens related to developer environments, cloud providers, source control, package registries, and cryptocurrency wallets. The malware can fully compromise the infected system, enabling attackers to exfiltrate secrets and potentially maintain persistent, hidden access via a kernel rootkit. The worm-like behavior allows attackers to spread by abusing stolen credentials to compromise additional repositories and publish further malicious packages.

No official patch or fix is currently available for this malicious package version. The vendor advisory is not provided, but the threat intelligence sources recommend immediate removal of the package. Systems with this package installed should be considered fully compromised; all secrets and keys must be rotated from a separate, trusted machine. Because the malware includes a kernel rootkit and extensive credential theft, full system reimaging is strongly advised to ensure complete eradication. Avoid installing this package version and verify package integrity before installation in the future.