Malicious code in @ibrahim1337/baksen (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ea195bd44e54cd1051fc279a0e871b02c15eea04f65c80979d756fa767f541b4) Package @ibrahim1337/baksen ships a Windows x64 infostealer toolkit that targets Chromium-family browsers (Chrome, Brave, Edge, Opera, Opera GX) on the machine running the CLI. The JS layer enumerates browser profile directories and reads the 'Local State', 'Cookies', and 'Login Data' SQLite databases, executing queries such as `SELECT origin_url, username_value, password_value FROM logins` and `SELECT host_key, name, encrypted_value,... FROM cookies`. It extracts the AES master key and the Chrome v20 `os_crypt.app_bound_encrypted_key` from Local State, then decrypts cookies and saved passwords with AES-256-GCM and writes the plaintext credentials to local `_cookies/` and `_passwords/` directories. A bundled opaque Windows native addon `build/Release/debugelevator.node` (declared in package.json `files`, `os: win32`, `cpu: x64`) performs the App-Bound key elevation — the documented technique used by recent Chromium infostealers to bypass Chrome v20 encryption. Strings inside the bundle include 'DebugElevator - scanning all detected browsers', 'Launching... browser(s) in parallel for App-Bound key', and 'APP-KEY'. A license module fetches an allowlist of valid keys from `https://raw.githubusercontent.com/tabo1337/SaatPCBKod/refs/heads/main/key.txt` (an account unrelated to the publisher) and caches the result at `~/.baksen_cache`, indicating a sold/distributed hacktool model. Package metadata is placeholder ('hadiyapic' description, `github.com/yourusername/baksen` repository URL) with no legitimate provenance. Installing and running this package on a Windows host with any of the listed browsers results in extraction of saved passwords and session cookies — credential theft against the machine running it.
AI Analysis
Technical Summary
The @ibrahim1337/baksen npm package contains malicious code designed to steal credentials from Chromium-family browsers (Chrome, Brave, Edge, Opera, Opera GX) on Windows x64 systems. It enumerates browser profiles and reads sensitive SQLite databases ('Local State', 'Cookies', 'Login Data'), extracting encrypted credentials. Using the AES master key and the Chrome v20 App-Bound encrypted key from the Local State file, it decrypts cookies and saved passwords with AES-256-GCM. A bundled native Windows addon performs App-Bound key elevation to bypass Chrome v20 encryption protections. The package also fetches a license allowlist from an unrelated GitHub repository, indicating a commercialized hacktool model. Package metadata is placeholder and lacks legitimate provenance. Running this package results in local credential theft.
Potential Impact
Installation and execution of this package on a Windows x64 host with Chromium-based browsers leads to theft of saved passwords and session cookies. This compromises user credentials and potentially enables unauthorized access to user accounts associated with those browsers. The malicious code bypasses Chrome's encryption protections using a native addon, increasing the severity of the credential exposure.
Mitigation Recommendations
No official patch or remediation is available for this malicious package. The best mitigation is to avoid installing or running the @ibrahim1337/baksen npm package. Security teams should block this package from being installed in their environments and monitor for its presence. Users should verify the provenance of npm packages before installation and prefer trusted sources. Since this is a malicious package rather than a vulnerability in legitimate software, removal and prevention of installation are the primary defenses.
Malicious code in @ibrahim1337/baksen (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ea195bd44e54cd1051fc279a0e871b02c15eea04f65c80979d756fa767f541b4) Package @ibrahim1337/baksen ships a Windows x64 infostealer toolkit that targets Chromium-family browsers (Chrome, Brave, Edge, Opera, Opera GX) on the machine running the CLI. The JS layer enumerates browser profile directories and reads the 'Local State', 'Cookies', and 'Login Data' SQLite databases, executing queries such as `SELECT origin_url, username_value, password_value FROM logins` and `SELECT host_key, name, encrypted_value,... FROM cookies`. It extracts the AES master key and the Chrome v20 `os_crypt.app_bound_encrypted_key` from Local State, then decrypts cookies and saved passwords with AES-256-GCM and writes the plaintext credentials to local `_cookies/` and `_passwords/` directories. A bundled opaque Windows native addon `build/Release/debugelevator.node` (declared in package.json `files`, `os: win32`, `cpu: x64`) performs the App-Bound key elevation — the documented technique used by recent Chromium infostealers to bypass Chrome v20 encryption. Strings inside the bundle include 'DebugElevator - scanning all detected browsers', 'Launching... browser(s) in parallel for App-Bound key', and 'APP-KEY'. A license module fetches an allowlist of valid keys from `https://raw.githubusercontent.com/tabo1337/SaatPCBKod/refs/heads/main/key.txt` (an account unrelated to the publisher) and caches the result at `~/.baksen_cache`, indicating a sold/distributed hacktool model. Package metadata is placeholder ('hadiyapic' description, `github.com/yourusername/baksen` repository URL) with no legitimate provenance. Installing and running this package on a Windows host with any of the listed browsers results in extraction of saved passwords and session cookies — credential theft against the machine running it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The @ibrahim1337/baksen npm package contains malicious code designed to steal credentials from Chromium-family browsers (Chrome, Brave, Edge, Opera, Opera GX) on Windows x64 systems. It enumerates browser profiles and reads sensitive SQLite databases ('Local State', 'Cookies', 'Login Data'), extracting encrypted credentials. Using the AES master key and the Chrome v20 App-Bound encrypted key from the Local State file, it decrypts cookies and saved passwords with AES-256-GCM. A bundled native Windows addon performs App-Bound key elevation to bypass Chrome v20 encryption protections. The package also fetches a license allowlist from an unrelated GitHub repository, indicating a commercialized hacktool model. Package metadata is placeholder and lacks legitimate provenance. Running this package results in local credential theft.
Potential Impact
Installation and execution of this package on a Windows x64 host with Chromium-based browsers leads to theft of saved passwords and session cookies. This compromises user credentials and potentially enables unauthorized access to user accounts associated with those browsers. The malicious code bypasses Chrome's encryption protections using a native addon, increasing the severity of the credential exposure.
Mitigation Recommendations
No official patch or remediation is available for this malicious package. The best mitigation is to avoid installing or running the @ibrahim1337/baksen npm package. Security teams should block this package from being installed in their environments and monitor for its presence. Users should verify the provenance of npm packages before installation and prefer trusted sources. Since this is a malicious package rather than a vulnerability in legitimate software, removal and prevention of installation are the primary defenses.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-6575
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a42ed6d27e9c79719938eb3
Added to database: 06/29/2026, 22:10:53 UTC
Last enriched: 07/07/2026, 00:57:24 UTC
Last updated: 07/29/2026, 15:23:19 UTC
Views: 35
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.