weavedb-node-client@0.45.3

Analysis

weavedb-node-client@0.45.3 is a trojanized clone of the legitimate WeaveDB gRPC client. It ships a 977KB ELF binary at tools/setup that executes during npm install via the preinstall lifecycle hook. This binary is the Mini Shai-Hulud worm (TeamPCP campaign) — a native dropper that downloads second-stage payloads and harvests NPM tokens and other credentials from the victim environment. The package also depends on weavedb-base (another compromised component in the same worm campaign). The preinstall hook runs: ./tools/setup. The legitimate index.js and weavedb.proto files serve as camouflage for the malicious binary payload.