-= Per source details. Do not edit below this line.=-
The package ships a single ~10 MB Rust-compiled Linux x8664 N-API native module (tools.linux-x64-gnu.node) referenced by main, with a two-line README that describes it only as a platform binary and no source. The binary embeds Chromium browser-secret extraction primitives — the Chromium cookies table schema (hostkey, topframesitekey, hascrosssiteancestor, unique-index DDL) and the Chrome Login Data password-store fingerprint (Found login for), plus SQLite/SQLCipher symbols including SQLITE_AUTH_USER — the components required to read Chrome/Chromium Cookies and Login Data stores on the host that loads the module. The same binary embeds a full HTTPS client (hyper, ureq, TLS 1.2/1.3 handshake constants, HTTP/2 framing) with proxy-environment awareness (HTTPS_PROXY, ALL_PROXY) and host-fingerprinting reads (/etc/lsb-release, /dev/disk/by-id/, bogomips per cpu, CPU implementer, network_adapters, gethostname) — the transport layer and host-identification data for exfiltration. The version tag 3.1.40-chrom-553-fix-undeletable-import-cookies-355-1784226602 labels the actual capability (Chromium cookie import) while the package name and README hide it behind a generic "native-tools" cover story. The exfil destination is assembled at runtime rather than appearing as a static literal, consistent with obfuscation of C2. Loading this module via require() exposes the installer's browser cookies and saved passwords to an attacker-controlled destination.
{
"malicious-packages-origins": [
{
"sha256": "b94a7936cc7587469e4bd2e3579e12bcb08ca55fb2de1b4ba49ceb45793ce65d",
"id": "IN-MAL-2026-014794",
"import_time": "2026-08-05T13:08:46.987701384Z",
"modified_time": "2026-08-05T12:52:14Z",
"source": "amazon-inspector",
"versions": [
"3.1.41-origin-chrom-468-delete-windows-32-bit-changelog-fix-408-1785838091"
]
},
{
"sha256": "c713b56fdb956dbd0caaa24969878e04aba9374f65d5fcfb8139771a012ff7cc",
"id": "IN-MAL-2026-014819",
"import_time": "2026-08-05T13:08:48.92568429Z",
"modified_time": "2026-08-05T12:56:48Z",
"source": "amazon-inspector",
"versions": [
"3.1.40-browser-release-151-380-1785161758"
]
},
{
"sha256": "b9804fbf84db23891baa705bf041c70fc0ed57241f4166538541e1f4c2030a5b",
"id": "IN-MAL-2026-015825",
"import_time": "2026-08-05T17:04:49.272484363Z",
"modified_time": "2026-08-05T16:17:49Z",
"source": "amazon-inspector",
"versions": [
"3.1.40-as2-9923-378-1785154830"
]
},
{
"sha256": "335f3dca4e8c9575e0a11bfa37d59d9ff45e04013c7474b23d52365a888c98f3",
"id": "IN-MAL-2026-016343",
"modified_time": "2026-08-06T13:07:21Z",
"import_time": "2026-08-06T13:09:16.536500305Z",
"source": "amazon-inspector",
"versions": [
"3.1.40-chrom-553-fix-undeletable-import-cookies-360-1784545605"
]
},
{
"sha256": "5421f8bf61ce10e7a54d2766cb40fef8065a55e68b6a01a39d27c523a8b2fa96",
"id": "IN-MAL-2026-016332",
"import_time": "2026-08-06T13:09:15.494373247Z",
"modified_time": "2026-08-06T13:05:41Z",
"versions": [
"3.1.42-origin-chrom-468-delete-windows-32-bit-changelog-fix-410-1785839786"
],
"source": "amazon-inspector"
},
{
"sha256": "799b6f9f8f20ed10747940fed038e71318b2e729ad4fd8481a279b1c985af99c",
"id": "IN-MAL-2026-016340",
"modified_time": "2026-08-06T13:06:53Z",
"import_time": "2026-08-06T13:09:16.256496221Z",
"source": "amazon-inspector",
"versions": [
"3.1.40-chrom-381-new-browser-icons-367-1784657143"
]
},
{
"sha256": "8851c16cbb0ba1771138293e2b8f7e83006f46558b182392fbb68ddc802ffb58",
"id": "IN-MAL-2026-016335",
"import_time": "2026-08-06T13:09:15.806340934Z",
"modified_time": "2026-08-06T13:06:09Z",
"source": "amazon-inspector",
"versions": [
"3.1.42-origin-chrom-468-delete-windows-32-bit-changelog-fix-416-1785842977"
]
},
{
"sha256": "8c8b2fb54647d1c897035acd4e39b87f5eb002f78827e1d9bb240c7d362dc4e5",
"id": "IN-MAL-2026-016334",
"import_time": "2026-08-06T13:09:15.678359119Z",
"modified_time": "2026-08-06T13:05:59Z",
"source": "amazon-inspector",
"versions": [
"3.1.42-origin-chrom-468-delete-windows-32-bit-changelog-fix-415-1785842368"
]
},
{
"sha256": "b19bf3fb208af50aec7fa98bd79ac232ff2397347ee56eeb6792e28eff5181d5",
"id": "IN-MAL-2026-016336",
"import_time": "2026-08-06T13:09:15.897548064Z",
"modified_time": "2026-08-06T13:06:17Z",
"source": "amazon-inspector",
"versions": [
"3.1.41-browser-release-151-upd-native-tools-397-1785772979"
]
},
{
"sha256": "405889ce22e2f0f74cc17e804284742d21be631fddd8d57b6165190815969268",
"id": "IN-MAL-2026-016344",
"import_time": "2026-08-06T13:09:16.624332493Z",
"modified_time": "2026-08-06T13:07:30Z",
"source": "amazon-inspector",
"versions": [
"3.1.40-chrom-468-delete-windows-32-bit-358-1784544836"
]
},
{
"sha256": "49ea02bca32e7f6082a10a5db0e4cdcead9b74d6176c97473b115203bf5ce88a",
"id": "IN-MAL-2026-016350",
"import_time": "2026-08-06T13:09:17.180215438Z",
"modified_time": "2026-08-06T13:08:25Z",
"source": "amazon-inspector",
"versions": [
"3.1.43-as2-9980-424-1785851759"
]
},
{
"sha256": "71c17f199f27497997d904e050021b5d6072724ecda1b7963b54eecd270669fd",
"id": "IN-MAL-2026-016337",
"import_time": "2026-08-06T13:09:15.988110071Z",
"modified_time": "2026-08-06T13:06:29Z",
"source": "amazon-inspector",
"versions": [
"3.1.41-chrom-381-new-browser-icons-391-1785747283"
]
},
{
"sha256": "ceee42c8124a9fb1596f6d72ef0581f522d12cd8773885a45663ea44b6a7adcc",
"id": "IN-MAL-2026-016347",
"import_time": "2026-08-06T13:09:16.903892633Z",
"modified_time": "2026-08-06T13:08:00Z",
"source": "amazon-inspector",
"versions": [
"3.1.40-browser-release-151-368-1784717346"
]
},
{
"sha256": "1ee149d2c70feea586557dc49412bd18439301c332c3d406587ec11804a9e929",
"id": "IN-MAL-2026-016339",
"import_time": "2026-08-06T13:09:16.170181218Z",
"modified_time": "2026-08-06T13:06:45Z",
"source": "amazon-inspector",
"versions": [
"3.1.40-browser-release-151-375-1784897296"
]
},
{
"sha256": "7fcb35912670732b580d500e04cebd71ebcb4848464af68e9b0d9d7957bebee6",
"id": "IN-MAL-2026-016333",
"import_time": "2026-08-06T13:09:15.583665759Z",
"modified_time": "2026-08-06T13:05:49Z",
"source": "amazon-inspector",
"versions": [
"3.1.42-origin-chrom-468-delete-windows-32-bit-changelog-fix-411-1785839911"
]
},
{
"sha256": "bc3f436c3e12665df00b7ef21717ffaa23c87c6243816389b426d9728361d31f",
"id": "IN-MAL-2026-016341",
"import_time": "2026-08-06T13:09:16.347306388Z",
"modified_time": "2026-08-06T13:07:02Z",
"source": "amazon-inspector",
"versions": [
"3.1.40-chrom-381-new-browser-icons-377-1785143176"
]
},
{
"sha256": "ce53e85be15a7941070fe8d99272d45dac403da3a452ffe49462b5a296e45332",
"id": "IN-MAL-2026-016348",
"import_time": "2026-08-06T13:09:16.997445947Z",
"modified_time": "2026-08-06T13:08:09Z",
"source": "amazon-inspector",
"versions": [
"3.1.40-browser-release-151-362-1784553070"
]
},
{
"sha256": "d565e639329b6bee1dec13bbf6f07e921a1bd84e9e3cd38f4700f4f338f7ebcb",
"id": "IN-MAL-2026-016331",
"import_time": "2026-08-06T13:09:15.402923947Z",
"modified_time": "2026-08-06T13:05:34Z",
"versions": [
"3.1.41-browser-release-151-upd-native-tools-398-1785774129"
],
"source": "amazon-inspector"
},
{
"sha256": "10911b6577e6a6c441d14f8abe420da0ca144d6669ae4b96d782c1095ecc17cf",
"id": "IN-MAL-2026-016342",
"import_time": "2026-08-06T13:09:16.443929826Z",
"modified_time": "2026-08-06T13:07:13Z",
"source": "amazon-inspector",
"versions": [
"3.1.40-browser-release-151-365-1784638523"
]
},
{
"sha256": "813609765c2a49271d4f11d5aaeac9266f45ebdc18c193854649fdcb6e2ca711",
"id": "IN-MAL-2026-016276",
"import_time": "2026-08-06T13:09:09.514980667Z",
"modified_time": "2026-08-06T12:57:23Z",
"versions": [
"3.1.44-as2-9980-433-1786011509"
],
"source": "amazon-inspector"
},
{
"sha256": "8513fc239f64bd58d0b8f51de3c6138f622371869ad690b4688e901beb2ea077",
"id": "IN-MAL-2026-016346",
"modified_time": "2026-08-06T13:07:51Z",
"import_time": "2026-08-06T13:09:16.810667137Z",
"source": "amazon-inspector",
"versions": [
"3.1.41-as2-9980-test-400-1785776624"
]
},
{
"sha256": "9f29c4e54a47127facaf2d9d246dda8c462d94d506aa98981342a840346d3fd9",
"id": "IN-MAL-2026-016338",
"import_time": "2026-08-06T13:09:16.079176017Z",
"modified_time": "2026-08-06T13:06:36Z",
"versions": [
"3.1.41-browser-release-151-389-1785423950"
],
"source": "amazon-inspector"
},
{
"sha256": "b38b165a8872e9c65dab5b230d8a4cc26e045f5fc3fd8502fd711652913af44a",
"id": "IN-MAL-2026-016345",
"import_time": "2026-08-06T13:09:16.717631913Z",
"modified_time": "2026-08-06T13:07:41Z",
"versions": [
"3.1.40-chrom-553-fix-undeletable-import-cookies-355-1784226602"
],
"source": "amazon-inspector"
},
{
"sha256": "ee3d8148ec04eda3ed6e347eb6a32885c49f01251d3884f0ef8838097283cb21",
"id": "IN-MAL-2026-016349",
"import_time": "2026-08-06T13:09:17.086114738Z",
"modified_time": "2026-08-06T13:08:18Z",
"source": "amazon-inspector",
"versions": [
"3.1.42"
]
},
{
"sha256": "8826c76bd3d4fa1c4b2c0e185a70a8227f06c178b85059d3b74208276e11ad32",
"id": "IN-MAL-2026-016358",
"import_time": "2026-08-06T14:19:45.04531157Z",
"modified_time": "2026-08-06T13:09:35Z",
"source": "amazon-inspector",
"versions": [
"3.1.40-browser-release-151-371-1784887043"
]
},
{
"sha256": "a75f4bcbc408497e8616689c51c175f38bc97fe37561bd8486a988a181a1f8ae",
"id": "IN-MAL-2026-016360",
"import_time": "2026-08-06T14:19:45.129213801Z",
"modified_time": "2026-08-06T13:09:55Z",
"source": "amazon-inspector",
"versions": [
"3.1.43"
]
},
{
"sha256": "d44ed442835ba812688f8565e0ac287b7cc25431e9ab24d557777dc3f8fc8ca4",
"id": "IN-MAL-2026-016353",
"import_time": "2026-08-06T14:19:44.854079728Z",
"modified_time": "2026-08-06T13:08:52Z",
"versions": [
"3.1.40-as2-9962-369-1784812980"
],
"source": "amazon-inspector"
},
{
"sha256": "d4e4e0a40888442d82bbb7b5b2451b399b923b3fe63fb515aa0e94ac53a94f3f",
"id": "IN-MAL-2026-016357",
"import_time": "2026-08-06T14:19:45.016207153Z",
"modified_time": "2026-08-06T13:09:27Z",
"source": "amazon-inspector",
"versions": [
"3.1.42-as2-9980-419-1785846283"
]
},
{
"sha256": "dfd500df795f66a8bca6852985e7b43823caa33dbcbcd114dc947df2994c598b",
"id": "IN-MAL-2026-016352",
"import_time": "2026-08-06T14:19:44.798545939Z",
"modified_time": "2026-08-06T13:08:44Z",
"source": "amazon-inspector",
"versions": [
"3.1.40-browser-release-151-363-1784553412"
]
},
{
"sha256": "ed6aa36fd4bfb061506c84ac32dae4e7c4449a7bc263270ebfcfbda1041dc18a",
"id": "IN-MAL-2026-016356",
"import_time": "2026-08-06T14:19:44.969193273Z",
"modified_time": "2026-08-06T13:09:19Z",
"versions": [
"3.1.40-browser-release-151-359-1784544869"
],
"source": "amazon-inspector"
},
{
"sha256": "2a427fcd6f49deb7e3510e2b0b32eea01d49b3fa7647c836ad0540424baecf78",
"id": "IN-MAL-2026-016355",
"import_time": "2026-08-06T14:19:44.937904092Z",
"modified_time": "2026-08-06T13:09:11Z",
"source": "amazon-inspector",
"versions": [
"3.1.41-origin-chrom-468-delete-windows-32-bit-changelog-fix-409-1785839050"
]
},
{
"sha256": "f12960e5fcfe782bbb1d148408be538f6523c406d62fb8d38d44b648847006c0",
"id": "IN-MAL-2026-016359",
"import_time": "2026-08-06T14:19:45.090910869Z",
"modified_time": "2026-08-06T13:09:43Z",
"source": "amazon-inspector",
"versions": [
"3.1.41-v2026.217.1-native-tools-392-1785759657"
]
},
{
"sha256": "512dc34d0b975bd0cdfb66f00b4cac18361c8ed8a29945d5015d569e9e5b69be",
"id": "IN-MAL-2026-016354",
"import_time": "2026-08-06T14:19:44.900567837Z",
"modified_time": "2026-08-06T13:09:00Z",
"source": "amazon-inspector",
"versions": [
"3.1.42-origin-chrom-468-delete-windows-32-bit-changelog-fix-412-1785840430"
]
},
{
"sha256": "85344ea723b7d33e1fbb5b11b1e3b5bb226d7b0f53736d36beb0f135af703616",
"id": "IN-MAL-2026-016351",
"import_time": "2026-08-06T14:19:44.708797533Z",
"modified_time": "2026-08-06T13:08:33Z",
"source": "amazon-inspector",
"versions": [
"3.1.40-browser-release-151-373-1784890024"
]
}
]
}[
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"name": "Embedded Malicious Code",
"description": "The product contains code that appears to be malicious in nature."
},
{
"cweId": "CWE-506",
"name": "Embedded Malicious Code",
"description": "The product contains code that appears to be malicious in nature."
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"name": "Embedded Malicious Code",
"description": "The product contains code that appears to be malicious in nature."
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"name": "Embedded Malicious Code",
"description": "The product contains code that appears to be malicious in nature."
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"name": "Embedded Malicious Code",
"description": "The product contains code that appears to be malicious in nature."
},
{
"cweId": "CWE-506",
"name": "Embedded Malicious Code",
"description": "The product contains code that appears to be malicious in nature."
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"name": "Embedded Malicious Code",
"description": "The product contains code that appears to be malicious in nature."
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"name": "Embedded Malicious Code",
"description": "The product contains code that appears to be malicious in nature."
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"name": "Embedded Malicious Code",
"description": "The product contains code that appears to be malicious in nature."
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
}
]
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/new-native-tools-linux-x64-gnu/MAL-2026-12402.json"
{
"evidence_files": [
{
"sha256": "3fa857b94e598d0c5541a548f47d349da1d12350600c713795d04822f0499e49",
"tlsh": "43a67d03fab104ecddaac830425e6573fb31b85943216ae71bd49b202e55fa1af3db51",
"path": "tools.linux-x64-gnu.node"
},
{
"sha256": "88ab198ec534c64b581423f4bcdce2bdbd5d14f9b7e125808f532b5cadfd9845",
"tlsh": "c8e06801d335891269e84a549bdd42c182a94cc3c09a7d0c760b652c1b3c213143f8ea",
"path": "package.json"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "c6cf7b5cfad45e33f3a0290b93c716b2a83ca507",
"sha512_sri": "sha512-30zi3pp32AssLIUXnAY7SR90QFZ/r7fmN/VCl4+Xr0IBuzlbJUsQt0MvOHavXuncnnMgJfSRKofmhyQCnMwAKQ=="
},
"filename": "new-native-tools-linux-x64-gnu-3.1.41-origin-chrom-468-delete-windows-32-bit-changelog-fix-408-1785838091.tgz"
}
]
}