The weavedb-contracts npm package version 0.45.2 was maliciously modified in the IronWorm campaign to include a preinstall hook that runs a Rust-built infostealer. This malware targets a wide range of developer credentials and cryptocurrency wallets, including injecting malicious code into the Exodus desktop wallet. It steals GitHub and npm credentials to push malicious updates and publish trojanized packages, enabling worm-like propagation. On Linux systems, it employs an eBPF kernel rootkit to conceal its processes and network activity. The compromise results in potential full control over affected systems and exfiltration of sensitive secrets and keys.

Systems with weavedb-contracts version 0.45.2 installed are at risk of full compromise. The malware can steal a broad spectrum of developer and cloud credentials, cryptocurrency wallet secrets, and source control tokens. It can propagate by pushing malicious updates to repositories and publishing trojanized packages, increasing the attack surface. The use of a kernel rootkit on Linux further hides malicious activity, complicating detection and remediation. All secrets and keys on affected systems should be considered compromised.

Immediate removal of the weavedb-contracts package version 0.45.2 is recommended. All secrets, keys, and credentials stored on affected systems must be rotated from a separate, trusted environment. Due to the malware's rootkit and worm-like behavior, full system compromise is possible; therefore, a thorough forensic investigation and system rebuild may be necessary. No official patch or fixed version is currently indicated; users should avoid this version entirely. Monitor vendor advisories for updates or official remediation guidance.