Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
Malicious package

new-native-tools-linux-x64-gnunpm

new-native-tools-linux-x64-gnu is a confirmed malicious npm package (MAL-2026-12402) that steals credentials and exfiltrates sensitive data (malicious versions 3.1.40-as2-9923-378-1785154830, 3.1.40-as2-9962-369-1784812980, 3.1.40-browser-release-151-359-1784544869…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in new-native-tools-linux-x64-gnu (npm)

MAL-2026-12402
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
npm uninstall new-native-tools-linux-x64-gnu

What this malware does

The package ships a single ~10 MB Rust-compiled Linux x86_64 N-API native module (tools.linux-x64-gnu.node) referenced by main, with a two-line README that describes it only as a platform binary and no source. The binary embeds Chromium browser-secret extraction primitives — the Chromium cookies table schema (host_key, top_frame_site_key, has_cross_site_ancestor, unique-index DDL) and the Chrome Login Data password-store fingerprint (Found login for), plus SQLite/SQLCipher symbols including SQLITE_AUTH_USER — the components required to read Chrome/Chromium Cookies and Login Data stores on the host that loads the module. The same binary embeds a full HTTPS client (hyper, ureq, TLS 1.2/1.3 handshake constants, HTTP/2 framing) with proxy-environment awareness (HTTPS_PROXY, ALL_PROXY) and host-fingerprinting reads (/etc/lsb-release, /dev/disk/by-id/, bogomips per cpu, CPU implementer, network_adapters, gethostname) — the transport layer and host-identification data for exfiltration. The version tag 3.1.40-chrom-553-fix-undeletable-import-cookies-355-1784226602 labels the actual capability (Chromium cookie import) while the package name and README hide it behind a generic "native-tools" cover story. The exfil destination is assembled at runtime rather than appearing as a static literal, consistent with obfuscation of C2. Loading this module via require() exposes the installer's browser cookies and saved passwords to an attacker-controlled destination.

Malicious versions

34 flagged
3.1.40-as2-9923-378-17851548303.1.40-as2-9962-369-17848129803.1.40-browser-release-151-359-17845448693.1.40-browser-release-151-362-17845530703.1.40-browser-release-151-363-17845534123.1.40-browser-release-151-365-17846385233.1.40-browser-release-151-368-17847173463.1.40-browser-release-151-371-17848870433.1.40-browser-release-151-373-17848900243.1.40-browser-release-151-375-17848972963.1.40-browser-release-151-380-17851617583.1.40-chrom-381-new-browser-icons-367-17846571433.1.40-chrom-381-new-browser-icons-377-17851431763.1.40-chrom-468-delete-windows-32-bit-358-17845448363.1.40-chrom-553-fix-undeletable-import-cookies-355-17842266023.1.40-chrom-553-fix-undeletable-import-cookies-360-17845456053.1.41-as2-9980-test-400-17857766243.1.41-browser-release-151-389-17854239503.1.41-browser-release-151-upd-native-tools-397-17857729793.1.41-browser-release-151-upd-native-tools-398-17857741293.1.41-chrom-381-new-browser-icons-391-17857472833.1.41-origin-chrom-468-delete-windows-32-bit-changelog-fix-408-17858380913.1.41-origin-chrom-468-delete-windows-32-bit-changelog-fix-409-17858390503.1.41-v2026.217.1-native-tools-392-17857596573.1.423.1.42-as2-9980-419-17858462833.1.42-origin-chrom-468-delete-windows-32-bit-changelog-fix-410-17858397863.1.42-origin-chrom-468-delete-windows-32-bit-changelog-fix-411-17858399113.1.42-origin-chrom-468-delete-windows-32-bit-changelog-fix-412-17858404303.1.42-origin-chrom-468-delete-windows-32-bit-changelog-fix-415-17858423683.1.42-origin-chrom-468-delete-windows-32-bit-changelog-fix-416-17858429773.1.433.1.43-as2-9980-424-17858517593.1.44-as2-9980-433-1786011509

Indicators of compromise (SHA-256)

b94a7936cc7587469e4bd2e3579e12bcb08ca55fb2de1b4ba49ceb45793ce65d
c713b56fdb956dbd0caaa24969878e04aba9374f65d5fcfb8139771a012ff7cc
b9804fbf84db23891baa705bf041c70fc0ed57241f4166538541e1f4c2030a5b
335f3dca4e8c9575e0a11bfa37d59d9ff45e04013c7474b23d52365a888c98f3
5421f8bf61ce10e7a54d2766cb40fef8065a55e68b6a01a39d27c523a8b2fa96
799b6f9f8f20ed10747940fed038e71318b2e729ad4fd8481a279b1c985af99c
8851c16cbb0ba1771138293e2b8f7e83006f46558b182392fbb68ddc802ffb58
8c8b2fb54647d1c897035acd4e39b87f5eb002f78827e1d9bb240c7d362dc4e5
b19bf3fb208af50aec7fa98bd79ac232ff2397347ee56eeb6792e28eff5181d5
405889ce22e2f0f74cc17e804284742d21be631fddd8d57b6165190815969268
49ea02bca32e7f6082a10a5db0e4cdcead9b74d6176c97473b115203bf5ce88a
71c17f199f27497997d904e050021b5d6072724ecda1b7963b54eecd270669fd
ceee42c8124a9fb1596f6d72ef0581f522d12cd8773885a45663ea44b6a7adcc
1ee149d2c70feea586557dc49412bd18439301c332c3d406587ec11804a9e929
7fcb35912670732b580d500e04cebd71ebcb4848464af68e9b0d9d7957bebee6
bc3f436c3e12665df00b7ef21717ffaa23c87c6243816389b426d9728361d31f
ce53e85be15a7941070fe8d99272d45dac403da3a452ffe49462b5a296e45332
d565e639329b6bee1dec13bbf6f07e921a1bd84e9e3cd38f4700f4f338f7ebcb
10911b6577e6a6c441d14f8abe420da0ca144d6669ae4b96d782c1095ecc17cf
813609765c2a49271d4f11d5aaeac9266f45ebdc18c193854649fdcb6e2ca711
8513fc239f64bd58d0b8f51de3c6138f622371869ad690b4688e901beb2ea077
9f29c4e54a47127facaf2d9d246dda8c462d94d506aa98981342a840346d3fd9
b38b165a8872e9c65dab5b230d8a4cc26e045f5fc3fd8502fd711652913af44a
ee3d8148ec04eda3ed6e347eb6a32885c49f01251d3884f0ef8838097283cb21
8826c76bd3d4fa1c4b2c0e185a70a8227f06c178b85059d3b74208276e11ad32
a75f4bcbc408497e8616689c51c175f38bc97fe37561bd8486a988a181a1f8ae
d44ed442835ba812688f8565e0ac287b7cc25431e9ab24d557777dc3f8fc8ca4
d4e4e0a40888442d82bbb7b5b2451b399b923b3fe63fb515aa0e94ac53a94f3f
dfd500df795f66a8bca6852985e7b43823caa33dbcbcd114dc947df2994c598b
ed6aa36fd4bfb061506c84ac32dae4e7c4449a7bc263270ebfcfbda1041dc18a
2a427fcd6f49deb7e3510e2b0b32eea01d49b3fa7647c836ad0540424baecf78
f12960e5fcfe782bbb1d148408be538f6523c406d62fb8d38d44b648847006c0
512dc34d0b975bd0cdfb66f00b4cac18361c8ed8a29945d5015d569e9e5b69be
85344ea723b7d33e1fbb5b11b1e3b5bb226d7b0f53736d36beb0f135af703616

Detection & response playbook

Credential / info stealer
  1. Find it

    Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for new-native-tools-linux-x64-gnu (34 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging new-native-tools-linux-x64-gnu across your stack and pipelines.

  2. If you installed it — respond

    new-native-tools-linux-x64-gnu is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

  3. Did it already run?

    If new-native-tools-linux-x64-gnu was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

  4. How O3 protects you

    O3 blocks new-native-tools-linux-x64-gnu before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. new-native-tools-linux-x64-gnu on npm has been identified as a malicious package (versions 3.1.40-as2-9923-378-1785154830, 3.1.40-as2-9962-369-1784812980, 3.1.40-browser-release-151-359-1784544869, 3.1.40-browser-release-151-362-1784553070, 3.1.40-browser-release-151-363-1784553412, 3.1.40-browser-release-151-365-1784638523, 3.1.40-browser-release-151-368-1784717346, 3.1.40-browser-release-151-371-1784887043, and 26 more flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-014794IN-MAL-2026-014819IN-MAL-2026-015825IN-MAL-2026-016343IN-MAL-2026-016332IN-MAL-2026-016340IN-MAL-2026-016335IN-MAL-2026-016334IN-MAL-2026-016336IN-MAL-2026-016344IN-MAL-2026-016350IN-MAL-2026-016337IN-MAL-2026-016347IN-MAL-2026-016339IN-MAL-2026-016333IN-MAL-2026-016341IN-MAL-2026-016348IN-MAL-2026-016331IN-MAL-2026-016342IN-MAL-2026-016276IN-MAL-2026-016346IN-MAL-2026-016338IN-MAL-2026-016345IN-MAL-2026-016349IN-MAL-2026-016358IN-MAL-2026-016360IN-MAL-2026-016353IN-MAL-2026-016357IN-MAL-2026-016352IN-MAL-2026-016356IN-MAL-2026-016355IN-MAL-2026-016359IN-MAL-2026-016354IN-MAL-2026-016351

References

Credits

  • Amazon Inspector · finder

Detect & block this

O3 blocks new-native-tools-linux-x64-gnu-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Explore

new-native-tools-linux-x64-gnu (npm) malicious package — MAL-2026-12402 | O3 Security