cold-debug-elevator is a malicious npm package that exports an API to steal browser credentials from installed Chromium-based browsers (Chrome, Edge, Brave) and Firefox-based browsers (Firefox, Thunderbird, Waterfox, SeaMonkey, Pale Moon, LibreWolf, Tor Browser). It achieves this by attaching a debugger to browser processes, locating and extracting the AppBound encryption key from process memory, decrypting the Local State master key, and querying browser databases to decrypt cookies, saved passwords, autofill, and history. For Firefox-based browsers, it loads nss3.dll and uses PK11SDR_Decrypt to recover saved passwords and copies relevant SQLite databases. The package is distributed as C++ source code that requires manual compilation and has no legitimate purpose other than credential theft.

If executed, this package can fully compromise the confidentiality of browser-stored credentials and sensitive browsing data on the affected system. This includes cookies, saved passwords, autofill information, and browsing history from multiple popular browsers. The stolen data can be used for account takeover, identity theft, and further attacks. However, exploitation requires manual building and execution of the malicious code by the user or attacker, limiting automatic or widespread exploitation.

No official patch or fix is available as this is a malicious package rather than a software vulnerability. The package requires manual compilation and execution, so avoiding installation and use of cold-debug-elevator is critical. Security teams should block or remove this package from development and build environments and educate users not to build or run untrusted source code. Monitor package sources and supply chains to prevent introduction of this malicious code. Since this is not a cloud service, remediation is user-driven.