new-native-tools-linux-x64-gnu @3.1.41-origin-chrom-468-delete-windows-32-bit-changelog-fix-408-1785838091
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12402
Ecosystem
npm
Summary
The package's only shipped artifact is a 10 MB Linux x86_64 ELF Node addon set as main (tools.linux-x64-gnu.node), so it is loaded automatically on require() . Extracted strings from the binary contain the exact Chromium Cookies SQLite schema ( FROM cookies , DROP INDEX IF EXISTS cookies_unique_index , CREATE UNIQUE INDEX cookies_unique_index ON cookies(host_key, top_frame_site_key,...) ) and password-store log lines ( Found login for , failed to read: ), consistent with reading Chromium/Chrome/Chromium-derivative Cookies and Login Data stores on the installer host. The same binary embeds a full outbound HTTPS stack (rustls, hyper/ureq) with proxy-environment support ( HTTPS_PROXY , HTTP_PROXY , ALL_PROXY ) and host-fingerprinting primitives ( gethostname , getifaddrs , /etc/lsb-release , /dev/disk/by-id/ , CPU info, network_adapters ), plus ZIP + zstd packaging routines suitable for bundling collected data before upload. The exfiltration destination is not present as a plain string and is reconstructed at runtime. Package name mimics the @napi-rs/* / @next/swc-* platform-binary convention; the README states only "the x86_64-unknown-linux-gnu binary for new-native-tools" and does not disclose any browser-data access or network activity. The version tag 3.1.40-browser-release-151-380-1785161758 includes a unix-epoch-like suffix consistent with automated mass-publication.
Source: amazon-inspector (c713b56fdb956dbd0caaa24969878e04aba9374f65d5fcfb8139771a012ff7cc)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.