The weavedb-client npm package version 0.45.3 contains a malicious preinstall script that executes a UPX-packed Linux ELF binary during installation. This binary acts as an infostealer targeting developer credentials such as SSH/PuTTY private keys, GitHub tokens, OAuth/Discord tokens, and environment variables. It also injects malicious code into the Exodus cryptocurrency wallet to capture sensitive data and uses worm-like behavior to propagate by stealing GitHub and npm credentials. The malware employs an eBPF-based kernel rootkit on Linux to hide its presence. Installation of this package version can lead to full system compromise.