The wao npm package versions 0.41.2, 0.41.3, and 0.41.4 contain a malicious preinstall lifecycle hook that executes a disguised native Linux ELF binary. This binary acts as a credential-harvesting implant with capabilities including eBPF and ptrace usage, outbound HTTPS exfiltration, and a secondary payload channel. The malware targets developer environments, stealing credentials for cloud providers, source control, package registries, AI tools, and cryptocurrency wallets. It also exhibits worm-like behavior by pushing malicious updates to repositories and publishing trojanized packages. The infection may result in full system compromise, and removing the package does not guarantee eradication of the malware.