weavedb-exm-sdk

{"modified":"2026-06-04T23:12:21Z","published":"2026-05-26T01:01:18Z","schema_version":"1.7.4","id":"MAL-2026-4718","summary":"Malicious code in weavedb-exm-sdk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (78ab05b11a1c784b066c89ffaff7bdf3a3351c611818e1d310cf718a64f20aec)\npackage.json declares `\"preinstall\": \"./vendor/setup\"`, causing every `npm install weavedb-exm-sdk` to execute vendor/setup — a 976,568-byte Linux x86 ELF that is UPX-packed (the `http://upx.sf.net` self-decompressor banner is present at offset ~4574). The package's advertised purpose is a pure-JS WeaveDB/EXM SDK that wraps @execution-machine/sdk, arweave, and ramda; the source tree contains no native code, no binding.gyp, no node-gyp build, and no documented reason to ship a Linux native binary. Strings recovered from the binary's tail include `LIBBPF`, `PTRACE`, `NETLINK`, `HTTP/1.1`, `POST`, `https://`, and `USERPROFILE` — capabilities (eBPF/ptrace/network) that a JavaScript SDK has no need for. UPX packing of an install-time payload is an intentional anti-analysis measure: the executable bytes are not auditable from the source tree. This is a textbook opaque-binary dropper at preinstall time — the installer runs attacker-controlled native code on every `npm install`, with no hash verification, no purpose match, and no transparency.\n\n## Source: google-open-source-security (146faaf0d97c6a533a969bc3f3f117811f9317dc865ed4ab37f1679842ddeaae)\nThis package was compromised as part of the IronWorm campaign. This campaign executes a malicious binary payload during installation via a preinstall hook. The payload is a Rust-built infostealer that targets developer environments, scanning for and harvesting credentials related to cloud providers, object storage, databases, source-control, package registries, and AI developer tools. It also targets cryptocurrency wallets, specifically injecting a malicious JavaScript hook into the Exodus desktop wallet to capture passwords and recovery phrases. Furthermore, the malware exhibits worm-like behavior by stealing GitHub and NPM credentials to push malicious updates to the victim's repositories and publish trojanized packages, and it uses an eBPF-based kernel rootkit to hide its processes and network connections on Linux systems.\n","affected":[{"package":{"ecosystem":"npm","name":"weavedb-exm-sdk"},"versions":["0.7.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"domains":["codeload.github.com"],"evidence_files":[{"path":"package.json","sha256":"c29737235ec9a53e6d09297fd934efaf634887100eadb2ce8d2494c371ea6253","tlsh":"b2f08170cd60d93305c415e058760146f2628c4b4d08fc9d33c3a20c4b5dd7b24be6ad"},{"path":"vendor/setup","sha256":"36abd242ddaa27f0160c539377a0e92cf781c1695137850acc87e3892b436d36","tlsh":"0c2533ab0025062b904d957a58963bd279c17c81afcc3662664dae742fb59c3cf63fc3"}],"package_integrity":[{"filename":"weavedb-exm-sdk-0.7.4.tgz","hashes":{"sha1":"aae92666ae06382901607ae2fd8bbe60917131ee","sha512_sri":"sha512-mUMUcB97qmOCXBwVZAX3AFYs8L+T6aAIUpNU9xDiA8FzibnPxc06nGmWEnH7LdZjr4J2CCDpDxLlbslPIkfMJg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/weavedb-exm-sdk/v/0.7.4"},{"type":"ARTICLE","url":"http://www.ox.security/blog/ironworm-supply-chain-malware-hits-npm/"},{"type":"ARTICLE","url":"https://research.jfrog.com/post/iron-worm-shai-hulud-rustier-cousin/"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","sha256":"3f1ea3d51113930c1f13cfdc5cd5996836d6daf9557c1c87e2e1435bfaec1b52","import_time":"2026-05-26T05:53:22.439435442Z","id":"IN-MAL-2026-004834","modified_time":"2026-05-26T01:01:28Z","versions":["0.7.4"]},{"source":"amazon-inspector","sha256":"78ab05b11a1c784b066c89ffaff7bdf3a3351c611818e1d310cf718a64f20aec","import_time":"2026-05-26T05:53:22.327076465Z","id":"IN-MAL-2026-004833","modified_time":"2026-05-26T01:01:18Z","versions":["0.7.4"]},{"source":"google-open-source-security","sha256":"146faaf0d97c6a533a969bc3f3f117811f9317dc865ed4ab37f1679842ddeaae","import_time":"2026-06-04T22:42:01.227855Z","modified_time":"2026-06-04T22:28:51.769005667Z","versions":["0.7.4"]}]}}