MalwarePublished 13 Jul 2026Updated 18 Aug 2026

cold-debug-elevator (npm) · Malicious Code

Affects cold-debug-elevatorSource GCVE Database

Malicious package : remove cold-debug-elevator and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10409

What to do

Remove cold-debug-elevator from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcold-debug-elevator	Affected 1.0.1 – 1.0.4 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The cold-debug-elevator npm package is a malicious tool disguised as a debugging utility. It contains code designed to steal browser credentials by extracting encryption keys and decrypting stored cookies, passwords, autofill data, and browsing history from Chromium-based browsers and Firefox-based browsers. The package requires manual building and execution, as it is distributed as C++ source code that fails to build normally without additional files. The tool targets local browser profiles to harvest sensitive user secrets and outputs the stolen data with identifiable branding.

Impact

If executed, this package can fully compromise the confidentiality of browser-stored credentials and sensitive browsing data on the affected system. This includes cookies, saved passwords, autofill information, and browsing history from multiple popular browsers. The stolen data can be used for account takeover, identity theft, and further attacks. However, exploitation requires manual building and execution of the malicious code by the user or attacker, limiting automatic or widespread exploitation.

Defensive guidance

The package requires manual compilation and execution, so avoiding installation and use of cold-debug-elevator is critical. Security teams should block or remove this package from development and build environments and educate users not to build or run untrusted source code. Monitor package sources and supply chains to prevent introduction of this malicious code. Since this is not a cloud service, remediation is user-driven.

Summary

cold-debug-elevator is a malicious npm package that exports an API to steal browser credentials from installed Chromium-based browsers (Chrome, Edge, Brave) and Firefox-based browsers (Firefox, Thunderbird, Waterfox, SeaMonkey, Pale Moon, LibreWolf, Tor Browser). It achieves this by attaching a debugger to browser processes, locating and extracting the AppBound encryption key from process memory, decrypting the Local State master key, and querying browser databases to decrypt cookies, saved passwords, autofill, and history. For Firefox-based browsers, it loads nss3.dll and uses PK11SDR_Decrypt to recover saved passwords and copies relevant SQLite databases. The package is distributed as C++ source code that requires manual compilation and has no legitimate purpose other than credential theft.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Jul 2026, 09:22 UTC

Technical details

References

Community reviews