weavedb-base@0.45.3

Analysis

weavedb-base@0.45.3 is a trojanized version of the legitimate WeaveDB decentralized database SDK. The package contains a preinstall lifecycle script ("./vendor/setup") that executes a bundled native ELF binary (vendor/setup, ~976KB) at install time. The npm publisher account was compromised, and the legitimate publisher later deprecated this version with a warning that it was infected by the Mini Shai-Hulud worm. The runtime execution of the binary failed in sandbox analysis (exit code 127), but the preinstall hook is armed and would execute the binary on any system where it runs successfully.