weavedb-sdk@0.45.3

Analysis

Package weavedb-sdk@0.45.3 is a trojanized clone of the legitimate WeaveDB SDK. It ships a 976KB UPX-packed ELF binary at `./tools/setup` executed via the `preinstall` lifecycle hook. The binary is a Mini Shai-Hulud worm variant: upon install it harvests environment variables including NPM_TOKEN from the victim's system and uses them to self-propagate by republishing malicious versions to other packages the victim maintains. The binary communicated with Cloudflare-protected endpoints (104.16.x.x range) during execution. The package was officially deprecated by npm with the message 'COMPROMISED via Mini Shai-Hulud worm (TeamPCP).' The package also pulls in known compromised dependencies (weavedb-base, weavedb-contracts) as secondary payload delivery mechanisms.