Skip to main content
MalwarePublished Updated

new-native-tools-linux-x64-gnu (npm) · Malicious Code

Affects new-native-tools-linux-x64-gnuSource GCVE Database

0

Malicious package : remove new-native-tools-linux-x64-gnu and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 18:24 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12402

What to do

Remove new-native-tools-linux-x64-gnu from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

ProductAffectedFixed in
npmnew-native-tools-linux-x64-gnuAffected
  • =3.1.41-origin-chrom-468-delete-windows-32-bit-changelog-fix-408-1785838091
  • =3.1.40-browser-release-151-380-1785161758
Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b38b165a8872e9c65dab5b230d8a4cc26e045f5fc3fd8502fd711652913af44a) The package ships a single ~10 MB Rust-compiled Linux x86_64 N-API native module (tools.linux-x64-gnu.node) referenced by `main`, with a two-line README that describes it only as a platform binary and no source. The binary embeds Chromium browser-secret extraction primitives — the Chromium `cookies` table schema (host_key, top_frame_site_key, has_cross_site_ancestor, unique-index DDL) and the Chrome Login Data password-store fingerprint (`Found login for`), plus SQLite/SQLCipher symbols including `SQLITE_AUTH_USER` — the components required to read Chrome/Chromium Cookies and Login Data stores on the host that loads the module. The same binary embeds a full HTTPS client (hyper, ureq, TLS 1.2/1.3 handshake constants, HTTP/2 framing) with proxy-environment awareness (`HTTPS_PROXY`, `ALL_PROXY`) and host-fingerprinting reads (`/etc/lsb-release`, `/dev/disk/by-id/`, `bogomips per cpu`, `CPU implementer`, `network_adapters`, `gethostname`) — the transport layer and host-identification data for exfiltration. The version tag `3.1.40-chrom-553-fix-undeletable-import-cookies-355-1784226602` labels the actual capability (Chromium cookie import) while the package name and README hide it behind a generic "native-tools" cover story. The exfil destination is assembled at runtime rather than appearing as a static literal, consistent with obfuscation of C2. Loading this module via `require()` exposes the installer's browser cookies and saved passwords to an attacker-controlled destination.

References

Community reviews

Loading reviews…