🛡️ MAL-2026-12402 — new-native-tools-linux-x64-gnu

Malicious code in new-native-tools-linux-x64-gnu (npm)

Source: amazon-inspector

The package ships a single ~10 MB Rust-compiled Linux x86_64 N-API native module (tools.linux-x64-gnu.node) referenced by main, with a two-line README that describes it only as a platform binary and no source. The binary embeds Chromium browser-secret extraction primitives — the Chromium cookies table schema (host_key, top_frame_site_key, has_cross_site_ancestor, unique-index DDL) and the Chrome Login Data password-store fingerprint (Found login for), plus SQLite/SQLCipher symbols including SQLITE_AUTH_USER — the components required to read Chrome/Chromium Cookies and Login Data stores on the host that loads the module. The same binary embeds a full HTTPS client (hyper, ureq, TLS 1.2/1.3 handshake constants, HTTP/2 framing) with proxy-environment awareness (HTTPS_PROXY, ALL_PROXY) and host-fingerprinting reads (/etc/lsb-release, /dev/disk/by-id/, bogomips per cpu, CPU implementer, network_adapters, gethostname) — the transport layer and host-identification data for exfiltration. The version tag 3.1.40-chrom-553-fix-undeletable-import-cookies-355-1784226602 labels the actual capability (Chromium cookie import) while the package name and README hide it behind a generic "native-tools" cover story. The exfil destination is assembled at runtime rather than appearing as a static literal, consistent with obfuscation of C2. Loading this module via require() exposes the installer's browser cookies and saved passwords to an attacker-controlled destination.