The weavedb-offchain npm package version 0.45.4 contains a malicious preinstall script that executes a 976 KB stripped ELF binary during installation. This binary includes capabilities such as eBPF kernel hooking, process tracing, raw socket enumeration, and modern cryptographic operations. It functions as an infostealer targeting developer environments by harvesting credentials for cloud providers, databases, source control, package registries, AI tools, and cryptocurrency wallets (notably injecting malicious hooks into the Exodus wallet). The malware exhibits worm-like behavior by stealing GitHub and npm credentials to propagate via malicious repository updates and trojanized packages. It also employs an eBPF-based kernel rootkit on Linux to conceal its activities. Installing this package version results in full system compromise.

Systems that install weavedb-offchain version 0.45.4 are fully compromised. The malware steals sensitive credentials and secrets, including cloud provider keys, source control tokens, package registry credentials, and cryptocurrency wallet information. It can propagate by pushing malicious code updates to victim repositories and publishing trojanized npm packages. The presence of a kernel rootkit allows it to hide its processes and network connections, making detection and remediation difficult. Consequently, all secrets on affected systems should be considered exposed and rotated immediately.

No official patch or fix is currently available for this malicious package version. The affected package version (=0.45.4) should be removed immediately from all systems. Because the malware executes with installer privileges and installs a kernel rootkit, affected systems should be considered fully compromised. All secrets and credentials stored on these systems must be rotated from a clean, uncompromised environment. Monitor for any unauthorized repository or package updates stemming from stolen credentials. Avoid installing this package version and verify package integrity before installation. Patch status is not yet confirmed — check the vendor advisory or trusted sources for any updates.