A coordinated campaign of malicious npm package releases in the WeaveDB/Arweave/AO ecosystem (publisher asteroiddao, published May 26, 2026), each adding a preinstall hook that executes the same ~976 KB UPX-packed Linux x86-64 ELF (sha256 36abd242…b436d36) disguised under misleading paths like src/deps.ts, dist/runtime.node, .github/scripts/precheck, or bin/install-deps. The binary runs with the installer's privileges on every npm install and its strings indicate a credential stealer: SSH/PuTTY key parsing, GitHub/OAuth/Discord token references, environment and home-directory enumeration, ptrace/eBPF anti-debug and kernel capabilities, and an HTTPS client for exfiltration.