new-native-tools-linux-x64-gnu @3.1.44-as2-9980-433-1786011509

Summary

The package ships a single ~10 MB Rust-compiled Linux x86_64 N-API native module (tools.linux-x64-gnu.node) referenced by main , with a two-line README that describes it only as a platform binary and no source. The binary embeds Chromium browser-secret extraction primitives — the Chromium cookies table schema (host_key, top_frame_site_key, has_cross_site_ancestor, unique-index DDL) and the Chrome Login Data password-store fingerprint ( Found login for ), plus SQLite/SQLCipher symbols including SQLITE_AUTH_USER — the components required to read Chrome/Chromium Cookies and Login Data stores on the host that loads the module. The same binary embeds a full HTTPS client (hyper, ureq, TLS 1.2/1.3 handshake constants, HTTP/2 framing) with proxy-environment awareness ( HTTPS_PROXY , ALL_PROXY ) and host-fingerprinting reads ( /etc/lsb-release , /dev/disk/by-id/ , bogomips per cpu , CPU implementer , network_adapters , gethostname ) — the transport layer and host-identification data for exfiltration. The version tag 3.1.40-chrom-553-fix-undeletable-import-cookies-355-1784226602 labels the actual capability (Chromium cookie import) while the package name and README hide it behind a generic "native-tools" cover story. The exfil destination is assembled at runtime rather than appearing as a static literal, consistent with obfuscation of C2. Loading this module via require() exposes the installer's browser cookies and saved passwords to an attacker-controlled destination.

Source: amazon-inspector (b38b165a8872e9c65dab5b230d8a4cc26e045f5fc3fd8502fd711652913af44a)