Native Modules are compiled Node.js files that allow Node.js applications to interface with native code written in languages like C, C++, or Objective-C. These files are compiled binaries that can contain machine code and run with the same privileges as the Node.js process that loads them. Unlike JavaScript files, .node files are not readable and can directly call system APIs and perform operations that pure JavaScript code cannot. These addons can use Objective-C++ to leverage native macOS APIs directly from Node.js, allowing arbitrary code execution outside the normal sandboxing. Electron applications often use the ASAR file format to package the application's source code, but ASAR integrity checking is disabled by default. When enabled, ASAR integrity checking verifies the header hash of the ASAR archive on runtime and prevents tampering with files within the archive. However, many applications run from outside the verified archive, under app.asar.unpacked, since compiled .node files cannot be executed directly from within an ASAR archive. This allows a local attacker to modify or replace .node files within the unpacked directory, similar to DLL hijacking on Windows. To address this issue, two tools have been developed: Electron ASAR Scanner, which assesses whether Electron applications implement ASAR integrity protection, and NodeLoader, a simple native Node.js addon compiler. The Electron ASAR Scanner and NodeLoader tools can help identify and mitigate potential security vulnerabilities in Electron applications that use native modules.