{
	"id": "fc26773a-c926-43ff-9039-03d1023667cd",
	"created_at": "2026-04-06T01:30:22.279524Z",
	"updated_at": "2026-04-10T03:36:48.020015Z",
	"deleted_at": null,
	"sha1_hash": "6473d00aa90acb863c038970881717f1f7a0b8c0",
	"title": "Native Node Modules | Electron",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 82568,
	"plain_text": "Native Node Modules | Electron\r\nArchived: 2026-04-06 00:12:39 UTC\r\nNative Node.js modules are supported by Electron, but since Electron has a different application binary interface\r\n(ABI) from a given Node.js binary (due to differences such as using Chromium's BoringSSL instead of\r\nOpenSSL), the native modules you use will need to be recompiled for Electron. Otherwise, you will get the\r\nfollowing class of error when you try to run your app:\r\nError: The module '/path/to/native/module.node'\r\nwas compiled against a different Node.js version using\r\nNODE_MODULE_VERSION $XYZ. This version of Node.js requires\r\nNODE_MODULE_VERSION $ABC. Please try re-compiling or re-installing\r\nthe module (for instance, using `npm rebuild` or `npm install`).\r\nHow to install native modules\r\nThere are several different ways to install native modules:\r\nInstalling modules and rebuilding for Electron\r\nYou can install modules like other Node projects, and then rebuild the modules for Electron with the\r\n@electron/rebuild package. This module can automatically determine the version of Electron and handle the\r\nmanual steps of downloading headers and rebuilding native modules for your app. If you are using Electron Forge,\r\nthis tool is used automatically in both development mode and when making distributables.\r\nFor example, to install the standalone @electron/rebuild tool and then rebuild modules with it via the command\r\nline:\r\nnpm install --save-dev @electron/rebuild\r\n# Every time you run \"npm install\", run this:\r\n./node_modules/.bin/electron-rebuild\r\n# If you have trouble on Windows, try:\r\n.\\node_modules\\.bin\\electron-rebuild.cmd\r\nFor more information on usage and integration with other tools such as Electron Packager, consult the project's\r\nREADME.\r\nUsing npm\r\nBy setting a few environment variables, you can use npm to install modules directly.\r\nhttps://www.electronjs.org/docs/latest/tutorial/using-native-node-modules\r\nPage 1 of 4\n\nFor example, to install all dependencies for Electron:\r\n# Electron's version.\r\nexport npm_config_target=1.2.3\r\n# The architecture of your machine\r\nexport npm_config_arch=x64\r\nexport npm_config_target_arch=x64\r\n# Download headers for Electron.\r\nexport npm_config_disturl=https://electronjs.org/headers\r\n# Tell node-pre-gyp that we are building for Electron.\r\nexport npm_config_runtime=electron\r\n# Tell node-pre-gyp to build module from source code.\r\nexport npm_config_build_from_source=true\r\n# Install all dependencies, and store cache to ~/.electron-gyp.\r\nHOME=~/.electron-gyp npm install\r\nManually building for Electron\r\nIf you are a developer developing a native module and want to test it against Electron, you might want to rebuild\r\nthe module for Electron manually. You can use node-gyp directly to build for Electron:\r\ncd /path-to-module/\r\nHOME=~/.electron-gyp node-gyp rebuild --target=1.2.3 --arch=x64 --dist-url=https://electronjs.org/headers\r\nHOME=~/.electron-gyp changes where to find development headers.\r\n--target=1.2.3 is the version of Electron.\r\n--dist-url=... specifies where to download the headers.\r\n--arch=x64 says the module is built for a 64-bit system.\r\nManually building for a custom build of Electron\r\nTo compile native Node modules against a custom build of Electron that doesn't match a public release, instruct\r\nnpm to use the version of Node you have bundled with your custom build.\r\nnpm rebuild --nodedir=/path/to/src/out/Default/gen/node_headers\r\nTroubleshooting\r\nIf you installed a native module and found it was not working, you need to check the following things:\r\nWhen in doubt, run @electron/rebuild first.\r\nMake sure the native module is compatible with the target platform and architecture for your Electron app.\r\nMake sure win_delay_load_hook is not set to false in the module's binding.gyp .\r\nAfter you upgrade Electron, you usually need to rebuild the modules.\r\nhttps://www.electronjs.org/docs/latest/tutorial/using-native-node-modules\r\nPage 2 of 4\n\nA note about win_delay_load_hook\r\nOn Windows, by default, node-gyp links native modules against node.dll . However, in Electron 4.x and\r\nhigher, the symbols needed by native modules are exported by electron.exe , and there is no node.dll . In\r\norder to load native modules on Windows, node-gyp installs a delay-load hook that triggers when the native\r\nmodule is loaded, and redirects the node.dll reference to use the loading executable instead of looking for\r\nnode.dll in the library search path (which would turn up nothing). As such, on Electron 4.x and higher,\r\n'win_delay_load_hook': 'true' is required to load native modules.\r\nIf you get an error like Module did not self-register , or The specified procedure could not be found , it\r\nmay mean that the module you're trying to use did not correctly include the delay-load hook. If the module is built\r\nwith node-gyp, ensure that the win_delay_load_hook variable is set to true in the binding.gyp file, and isn't\r\ngetting overridden anywhere. If the module is built with another system, you'll need to ensure that you build with\r\na delay-load hook installed in the main .node file. Your link.exe invocation should look like this:\r\n link.exe /OUT:\"foo.node\" \"...\\node.lib\" delayimp.lib /DELAYLOAD:node.exe /DLL\r\n \"my_addon.obj\" \"win_delay_load_hook.obj\"\r\nIn particular, it's important that:\r\nyou link against node.lib from Electron and not Node. If you link against the wrong node.lib you will\r\nget load-time errors when you require the module in Electron.\r\nyou include the flag /DELAYLOAD:node.exe . If the node.exe link is not delayed, then the delay-load hook\r\nwon't get a chance to fire and the node symbols won't be correctly resolved.\r\nwin_delay_load_hook.obj is linked directly into the final DLL. If the hook is set up in a dependent DLL,\r\nit won't fire at the right time.\r\nSee node-gyp for an example delay-load hook if you're implementing your own.\r\nModules that rely on prebuild\r\nprebuild provides a way to publish native Node modules with prebuilt binaries for multiple versions of Node\r\nand Electron.\r\nIf the prebuild -powered module provides binaries for the usage in Electron, make sure to omit --build-from-source and the npm_config_build_from_source environment variable in order to take full advantage of the\r\nprebuilt binaries.\r\nModules that rely on node-pre-gyp\r\nThe node-pre-gyp tool provides a way to deploy native Node modules with prebuilt binaries, and many popular\r\nmodules are using it.\r\nSometimes those modules work fine under Electron, but when there are no Electron-specific binaries available,\r\nyou'll need to build from source. Because of this, it is recommended to use @electron/rebuild for these\r\nhttps://www.electronjs.org/docs/latest/tutorial/using-native-node-modules\r\nPage 3 of 4\n\nmodules.\r\nIf you are following the npm way of installing modules, you'll need to pass --build-from-source to npm , or\r\nset the npm_config_build_from_source environment variable.\r\nSource: https://www.electronjs.org/docs/latest/tutorial/using-native-node-modules\r\nhttps://www.electronjs.org/docs/latest/tutorial/using-native-node-modules\r\nPage 4 of 4",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://www.electronjs.org/docs/latest/tutorial/using-native-node-modules"
	],
	"report_names": [
		"using-native-node-modules"
	],
	"threat_actors": [
		{
			"id": "9f101d9c-05ea-48b9-b6f1-168cd6d06d12",
			"created_at": "2023-01-06T13:46:39.396409Z",
			"updated_at": "2026-04-10T02:00:03.312816Z",
			"deleted_at": null,
			"main_name": "Earth Lusca",
			"aliases": [
				"CHROMIUM",
				"ControlX",
				"TAG-22",
				"BRONZE UNIVERSITY",
				"AQUATIC PANDA",
				"RedHotel",
				"Charcoal Typhoon",
				"Red Scylla",
				"Red Dev 10",
				"BountyGlad"
			],
			"source_name": "MISPGALAXY:Earth Lusca",
			"tools": [
				"RouterGod",
				"SprySOCKS",
				"ShadowPad",
				"POISONPLUG",
				"Barlaiy",
				"Spyder",
				"FunnySwitch"
			],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "18a7b52d-a1cd-43a3-8982-7324e3e676b7",
			"created_at": "2025-08-07T02:03:24.688416Z",
			"updated_at": "2026-04-10T02:00:03.734754Z",
			"deleted_at": null,
			"main_name": "BRONZE UNIVERSITY",
			"aliases": [
				"Aquatic Panda",
				"Aquatic Panda ",
				"CHROMIUM",
				"CHROMIUM ",
				"Charcoal Typhoon",
				"Charcoal Typhoon ",
				"Earth Lusca",
				"Earth Lusca ",
				"FISHMONGER ",
				"Red Dev 10",
				"Red Dev 10 ",
				"Red Scylla",
				"Red Scylla ",
				"RedHotel",
				"RedHotel ",
				"Tag-22",
				"Tag-22 "
			],
			"source_name": "Secureworks:BRONZE UNIVERSITY",
			"tools": [
				"Cobalt Strike",
				"Fishmaster",
				"FunnySwitch",
				"Spyder",
				"njRAT"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "6abcc917-035c-4e9b-a53f-eaee636749c3",
			"created_at": "2022-10-25T16:07:23.565337Z",
			"updated_at": "2026-04-10T02:00:04.668393Z",
			"deleted_at": null,
			"main_name": "Earth Lusca",
			"aliases": [
				"Bronze University",
				"Charcoal Typhoon",
				"Chromium",
				"G1006",
				"Red Dev 10",
				"Red Scylla"
			],
			"source_name": "ETDA:Earth Lusca",
			"tools": [
				"Agentemis",
				"AntSword",
				"BIOPASS",
				"BIOPASS RAT",
				"BadPotato",
				"Behinder",
				"BleDoor",
				"Cobalt Strike",
				"CobaltStrike",
				"Doraemon",
				"FRP",
				"Fast Reverse Proxy",
				"FunnySwitch",
				"HUC Port Banner Scanner",
				"KTLVdoor",
				"Mimikatz",
				"NBTscan",
				"POISONPLUG.SHADOW",
				"PipeMon",
				"RbDoor",
				"RibDoor",
				"RouterGod",
				"SAMRID",
				"ShadowPad Winnti",
				"SprySOCKS",
				"WinRAR",
				"Winnti",
				"XShellGhost",
				"cobeacon",
				"fscan",
				"lcx",
				"nbtscan"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "d53593c3-2819-4af3-bf16-0c39edc64920",
			"created_at": "2022-10-27T08:27:13.212301Z",
			"updated_at": "2026-04-10T02:00:05.272802Z",
			"deleted_at": null,
			"main_name": "Earth Lusca",
			"aliases": [
				"Earth Lusca",
				"TAG-22",
				"Charcoal Typhoon",
				"CHROMIUM",
				"ControlX"
			],
			"source_name": "MITRE:Earth Lusca",
			"tools": [
				"Mimikatz",
				"PowerSploit",
				"Tasklist",
				"certutil",
				"Cobalt Strike",
				"Winnti for Linux",
				"Nltest",
				"NBTscan",
				"ShadowPad"
			],
			"source_id": "MITRE",
			"reports": null
		}
	],
	"ts_created_at": 1775439022,
	"ts_updated_at": 1775792208,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/6473d00aa90acb863c038970881717f1f7a0b8c0.pdf",
		"text": "https://archive.orkl.eu/6473d00aa90acb863c038970881717f1f7a0b8c0.txt",
		"img": "https://archive.orkl.eu/6473d00aa90acb863c038970881717f1f7a0b8c0.jpg"
	}
}