MalwarePublished 4 Jun 2026Updated 14 Jul 2026

weavedb-contracts (npm) · Malicious Code

Affects weavedb-contractsSource GCVE Database

Malicious package : remove weavedb-contracts and rotate any secrets on hosts that installed it.

Data as of 14 Jul 2026, 09:36 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5192

What to do

Remove weavedb-contracts from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmweavedb-contracts	Affected =0.45.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package weavedb-contracts version 0.45.2 was compromised as part of the IronWorm campaign. The malicious code executes a Rust-based infostealer during installation via a preinstall hook, targeting developer credentials for cloud providers, databases, source control, package registries, AI tools, and cryptocurrency wallets. It also injects malicious JavaScript into the Exodus wallet to capture sensitive data. The malware exhibits worm-like behavior by stealing GitHub and npm credentials to propagate itself through repositories and trojanized packages. Additionally, it uses an eBPF-based kernel rootkit on Linux to hide its presence. Installing this package can lead to full system compromise.

Impact

Systems with weavedb-contracts version 0.45.2 installed are at risk of full compromise. The malware can steal a broad spectrum of developer and cloud credentials, cryptocurrency wallet secrets, and source control tokens. It can propagate by pushing malicious updates to repositories and publishing trojanized packages, increasing the attack surface. The use of a kernel rootkit on Linux further hides malicious activity, complicating detection and remediation. All secrets and keys on affected systems should be considered compromised.

Defensive guidance

Immediate removal of the weavedb-contracts package version 0.45.2 is recommended. All secrets, keys, and credentials stored on affected systems must be rotated from a separate, trusted environment. Due to the malware's rootkit and worm-like behavior, full system compromise is possible; therefore, a thorough forensic investigation and system rebuild may be necessary. Monitor vendor advisories for updates or official remediation guidance.

Summary

The weavedb-contracts npm package version 0.45.2 was maliciously modified in the IronWorm campaign to include a preinstall hook that runs a Rust-built infostealer. This malware targets a wide range of developer credentials and cryptocurrency wallets, including injecting malicious code into the Exodus desktop wallet. It steals GitHub and npm credentials to push malicious updates and publish trojanized packages, enabling worm-like propagation. On Linux systems, it employs an eBPF kernel rootkit to conceal its processes and network activity. The compromise results in potential full control over affected systems and exfiltration of sensitive secrets and keys.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Jul 2026, 09:36 UTC

Technical details

References

Community reviews