MAL-2026-12402

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (b38b165a8872e9c65dab5b230d8a4cc26e045f5fc3fd8502fd711652913af44a) The package ships a single ~10 MB Rust-compiled Linux x86_64 N-API native module (tools.linux-x64-gnu.node) referenced by `main`, with a two-line README that describes it only as a platform binary and no source. The binary embeds Chromium browser-secret extraction primitives — the Chromium `cookies` table schema (host_key, top_frame_site_key, has_cross_site_ancestor, unique-index DDL) and the Chrome Login Data password-store fingerprint (`Found login for`), plus SQLite/SQLCipher symbols including `SQLITE_AUTH_USER` — the components required to read Chrome/Chromium Cookies and Login Data stores on the host that loads the module. The same binary embeds a full HTTPS client (hyper, ureq, TLS 1.2/1.3 handshake constants, HTTP/2 framing) with proxy-environment awareness (`HTTPS_PROXY`, `ALL_PROXY`) and host-fingerprinting reads (`/etc/lsb-release`, `/dev/disk/by-id/`, `bogomips per cpu`, `CPU implementer`, `network_adapters`, `gethostname`) — the transport layer and host-identification data for exfiltration. The version tag `3.1.40-chrom-553-fix-undeletable-import-cookies-355-1784226602` labels the actual capability (Chromium cookie import) while the package name and README hide it behind a generic "native-tools" cover story. The exfil destination is assembled at runtime rather than appearing as a static literal, consistent with obfuscation of C2. Loading this module via `require()` exposes the installer's browser cookies and saved passwords to an attacker-controlled destination.