The weavedb-offchain npm package version 0.45.4 was compromised by the IronWorm campaign, which introduced a malicious preinstall hook executing a large ELF binary. This binary acts as an infostealer targeting developer credentials, cloud secrets, cryptocurrency wallets, and uses advanced techniques including eBPF kernel rootkits to hide its presence. The malware can propagate by stealing GitHub and npm credentials to push malicious updates and trojanized packages. Any system installing this package version is considered fully compromised.