The weavedb-base npm package version 0.45.3 contains a malicious preinstall script that executes a packed Linux ELF binary during installation. This binary acts as an infostealer targeting developer credentials, cryptocurrency wallets, and uses kernel rootkit techniques to hide its presence. The malware can propagate by stealing GitHub and npm credentials to push malicious updates and publish trojanized packages. Systems with this package installed should be considered fully compromised.