cwao-units

package.json declares `"preinstall": "./scripts/postbuild"`, where scripts/postbuild is a 976,568-byte Linux x86-64 ELF binary shipped in the tarball with no corresponding source, no native build configuration (no binding.gyp, no.c/.cc/.rs files, no node-gyp/cmake-js/prebuild-install tooling), and no mention in README. The package self-describes as a pure-JS Arweave/AO unit runner whose declared dependencies (arweave, express, cors, ramda, weavedb) are all pure JavaScript — there is no legitimate cover story for a platform-specific native binary. Strings inside the ELF include LIBBPF_0.0, PTRACE, NETLINK, HTTP/1.1, https://, Ed25519/RSA/MLKEM crypto primitives, and USERPROFILE, indicating network-capable, BPF/ptrace-capable native code. Every `npm install cwao-units` executes this opaque binary as the installer's user before the package is even loaded. The filename `postbuild` is suggestively chosen to mimic a benign build artifact, and the binary is invoked as a preinstall (not postinstall) hook so it fires before any inspection. This matches the canonical opaque-binary dropper pattern: doc-mismatch + thin lifecycle-script wrapper + undocumented native code with networking/tracing primitives. ## Source: google-open-source-security (146faaf0d97c6a533a969bc3f3f117811f9317dc865ed4ab37f1679842ddeaae) This package was compromised as part of the IronWorm campaign. This campaign executes a malicious binary payload during installation via a preinstall hook. The payload is a Rust-built infostealer that targets developer environments, scanning for and harvesting credentials related to cloud providers, object storage, databases, source-control, package registries, and AI developer tools. It also targets cryptocurrency wallets, specifically injecting a malicious JavaScript hook into the Exodus desktop wallet to capture passwords and recovery phrases. Furthermore, the malware exhibits worm-like behavior by stealing GitHub and NPM credentials to push malicious updates to the victim's repositories and publish trojanized packages, and it uses an eBPF-based kernel rootkit to hide its processes and network connections on Linux systems.