⌘ + K

MAL-2026-12402

Dashboard / Malicious Package / MAL-2026-12402

MAL-2026-12402

Published: 5 Aug 2026Last Modified: 6 Aug 2026

Summary: Malicious code in new-native-tools-linux-x64-gnu (npm)

Details: Source: amazon-inspector (b38b165a8872e9c65dab5b230d8a4cc26e045f5fc3fd8502fd711652913af44a) The package ships a single ~10 MB Rust-compiled Linux x86_64 N-API native module (tools.linux-x64-gnu.node) referenced by `main`, with a two-line README that describes it only as a platform binary and no source. The binary embeds Chromium browser-secret extraction primitives — the Chromium `cookies` table schema (host_key, top_frame_site_key, has_cross_site_ancestor, unique-index DDL) and the Chrome Login Data password-store fingerprint (`Found login for`), plus SQLite/SQLCipher symbols including `SQLITE_AUTH_USER` — the components required to read Chrome/Chromium Cookies and Login Data stores on the host that loads the module. The same binary embeds a full HTTPS client (hyper, ureq, TLS 1.2/1.3 handshake constants, HTTP/2 framing) with proxy-environment awareness (`HTTPS_PROXY`, `ALL_PROXY`) and host-fingerprinting reads (`/etc/lsb-release`, `/dev/disk/by-id/`, `bogomips per cpu`, `CPU implementer`, `network_adapters`, `gethostname`) — the transport layer and host-identification data for exfiltration. The version tag `3.1.40-chrom-553-fix-undeletable-import-cookies-355-1784226602` labels the actual capability (Chromium cookie import) while the package name and README hide it behind a generic "native-tools" cover story. The exfil destination is assembled at runtime rather than appearing as a static literal, consistent with obfuscation of C2. Loading this module via `require()` exposes the installer's browser cookies and saved passwords to an attacker-controlled destination.

Affected packages

Package

Name: new-native-tools-linux-x64-gnu

Purl: pkg:npm/new-native-tools-linux-x64-gnu

Affected ranges

Type: N/A

Events:

Introduced- None

Fixed -None

Affected versions

3.1.41-origin-chrom-468-delete-windows-32-bit-changelog-fix-408-1785838091

3.1.40-browser-release-151-380-1785161758

3.1.40-as2-9923-378-1785154830

3.1.40-chrom-553-fix-undeletable-import-cookies-360-1784545605

3.1.42-origin-chrom-468-delete-windows-32-bit-changelog-fix-410-1785839786

3.1.40-chrom-381-new-browser-icons-367-1784657143

3.1.42-origin-chrom-468-delete-windows-32-bit-changelog-fix-416-1785842977

3.1.42-origin-chrom-468-delete-windows-32-bit-changelog-fix-415-1785842368

3.1.41-browser-release-151-upd-native-tools-397-1785772979

3.1.40-chrom-468-delete-windows-32-bit-358-1784544836

3.1.43-as2-9980-424-1785851759

3.1.41-chrom-381-new-browser-icons-391-1785747283

3.1.40-browser-release-151-368-1784717346

3.1.40-browser-release-151-375-1784897296

3.1.42-origin-chrom-468-delete-windows-32-bit-changelog-fix-411-1785839911

3.1.40-chrom-381-new-browser-icons-377-1785143176

3.1.40-browser-release-151-362-1784553070

3.1.41-browser-release-151-upd-native-tools-398-1785774129

3.1.40-browser-release-151-365-1784638523

3.1.44-as2-9980-433-1786011509

3.1.41-as2-9980-test-400-1785776624

3.1.41-browser-release-151-389-1785423950

3.1.40-chrom-553-fix-undeletable-import-cookies-355-1784226602

3.1.42

3.1.40-browser-release-151-371-1784887043

3.1.43

3.1.40-as2-9962-369-1784812980

3.1.42-as2-9980-419-1785846283

3.1.40-browser-release-151-363-1784553412

3.1.40-browser-release-151-359-1784544869

3.1.41-origin-chrom-468-delete-windows-32-bit-changelog-fix-409-1785839050

3.1.41-v2026.217.1-native-tools-392-1785759657

3.1.42-origin-chrom-468-delete-windows-32-bit-changelog-fix-412-1785840430

3.1.40-browser-release-151-373-1784890024