weavedb-offchain@0.45.4

Analysis

This version of weavedb-offchain is a trojanized release of the legitimate WeaveDB library. The package JSON contains a preinstall lifecycle script ("preinstall": "./.github/scripts/precheck") that points at a bundled 64-bit ELF Linux executable (~977 KB) shipped inside the tarball at .github/scripts/precheck, disguised as a CI helper. Because it is wired to the preinstall hook, the native binary runs automatically as soon as a consumer installs the package via npm or yarn, before any package code is imported and with no user interaction. The library JavaScript itself is the unmodified upstream WeaveDB code, so the malicious capability lives entirely in the compiled binary executed at install time. Companion packages weavedb-base and weavedb-contracts are part of the same campaign.