WeaselBiscuit is a lean new infostealer hiding in npm that we suspect was created by DPRK

Analysis of the WeaselBiscuit JavaScript stealer spreading via 13 npm packages to harvest sensitive Chrome extension data and developer credentials.

Thirteen npm packages deliver WeaselBiscuit, a JavaScript stealer that harvests Chrome extension storage across Windows, macOS, and Linux.

Groups Conversations All groups and messages Sign in Technical - Malware Conversations About Privacy • Terms     WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials 0 views Eyal Estrin unread, 4:45 AM (8 minutes ago)    to https://opensourcemalware.com/blog/introducing-weaselbiscuit Eyal Estrin Author | Cloud Architect | AWS • Azure • GCP Insights Social: @eyalestrin Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com Reply all Reply to author Forward

Cybersecurity researchers have discovered a cluster of 13 npm packages that have been found to deliver a previously undocumented JavaScript stealer codenamed WeaselBiscuit. The new malware family, per OpenSourceMalware, exhibits functional overlaps with two malware strains associated with the Democratic People's Republic of Korea's (DPRK) Contagious Interview campaign: BeaverTail and

Threat actors are distributing 13 malicious npm packages that deliver a new, lightweight JavaScript stealer named WeaselBiscuit. The malware shows […]

Researchers have discovered 13 npm packages carrying a previously undocumented JavaScript information stealer called WeaselBiscuit, introducing yet another malicious threat to the npm package ecosystem. In addition to linking the packages together via shared indicators, OpenSourceMalware found several similarities between BeaverTail and OtterCookie, two North Korean malware families.  A number of packages are included, including @biz44/id10-client, @biz44/id12-client, @biz44/id44-client, @biz44/id79-client, @biz44/id95-client, @biz44/id99-client, @biz44/process-runtime-utils, @biz44/runtime-utils, @biz44/engin1, id79-client, process-lhpm, process-mite, and process-tailwind. Many were first observed between September 12 and September 16, 2026, with some versions still available on NPM at the time of analysis.  In comparison to BeaverTail and OtterCookie, WeaselBiscuit appears much smaller. In addition to remote access and cryptocurrency theft functions, the malware focuses on profiling hosts and collecting data collected by Chrome extensions rather than carrying a broad range of remote access functions. Malware loaders are launched when a compromised package is imported, causing detached Node.js processes to begin execution. After retrieving an encoded payload from an Npoint URL, the loader executes the decoded code directly in memory. Following execution, the malware obtains its command-and-control configuration from another Npoint endpoint before connecting to 103.170.217.184:8787. Among the data collected are hostnames, usernames, operating systems, CPUs, and memory, as well as local and public IP addresses.  Chrome profiles are also searched for extension storage on Windows, Mac OS, and Linux platforms. Chrome's Local Extension Settings directory may contain information associated with browser extensions, including cryptocurrency wallet extensions, which makes this collection especially significant.  Instead of relying on a specific list of wallet extensions, OpenSourceMalware reported the stealer uploads readable, non-empty files from these locations. C2 servers can also provide commands for monitoring the clipboard and logging Windows keystrokes.  Despite these capabilities, the recovered malware does not include direct wallet draining functionality, browser password decryption, seed phrase searching, screenshots, or a remote shell access. Additionally, some BeaverTail and OtterCookie activities have a Python-based InvisibleFerret stage that is not present in any other activity.  Possible Links to DPRK Malware WeaselBiscuit has been compared to malware associated with the DPRK-linked Contagious Interview campaign, but the attribution has yet to be confirmed. OpenSourceMalware did not find conclusive evidence that the attack was originated by North Korea based on operational infrastructure, victimology, campaign metadata or other identifying materials.  WeaselBiscuit employs the dead-drop technique of Npoint.io as a dead-drop service, a technique previously observed in Contagious Interview campaigns. Some of its technical indicators, however, overlap with earlier campaigns. Additionally, its code performs public IP and geolocation checks using IPify.org and IP-API.com, while parts of its command-and-control design are similar to OtterCookie's.  Among the numeric identifiers found in the malware are 10, 12, 44, 79, 95, and 99. These identifiers are similar to campaign markers associated with PolinRider activity, however their exact purpose in WeaselBiscuit is unclear. In terms of capability, BeaverTail and OtterCookie are more closely related.  Several features are retained in WhistlerBiscuit, including system profiling, Chrome extension data collection, clipboard monitoring, and keylogging, all of which are common to those malware families. However, several of their heavier features are removed, including remote access functions, wallet draining capabilities, screenshots, and secondary payload delivery.  Researchers at Cisco Talos observed a similar overlap in October 2025, when they discovered that the node-nvm-ssh package contained characteristics related to both BeaverTail and OtterCookie. The findings suggest that code and techniques from these malware families have been found in a variety of combinations within npm-based malicious code.  The WeaselBiscuit stealer should be viewed for the time being as a distinctive lightweight stealer with distinct technical similarities to DPRK-related tooling rather than a new DPRK malware family confirmed by the DPRK. For a more conclusive attribution, further evidence from infrastructure, campaigns, or code levels would be required. With the discovery of WeaselBiscuit, security risks are highlighted within the npm ecosystem, particularly for developers utilizing third-party packages. In addition to the ability to collect Chrome extension data and similarity to BeaverTail and OtterCookie, it warrants continued investigation as researchers investigate its origins and wider activities.

Thirteen npm packages deliver WeaselBiscuit, a JavaScript stealer that harvests Chrome extension storage across Windows, macOS, and Linux.

Haz clic para acceder al contenido completo.

JavaScriptスティーラー「WeaselBiscuit」がnpmパッケージ13個に混入。Windows・macOS・Linuxで動作し、Chrome拡張機能のストレージを盗聴します。npmの依存関係チェックが重要です。

Cybersecurity researchers have discovered a cluster of 13 npm packages that have been found to deliver a previously undocumented JavaScript stealer codenamed WeaselBiscuit. The new malware family, per OpenSourceMalware, exhibits functional overlaps with two malware strains associated with the Democratic People's Republic of Korea's (DPRK) Contagious Interview campaign: BeaverTail and

Cybersecurity researchers have discovered a cluster of 13 npm packages that have been found to deliver a previously undocumented JavaScript stealer codenamed WeaselBiscuit. The new malware family, per OpenSourceMalware, exhibits functional overlaps with two malware strains associated with the Democratic People's Republic of Korea's (DPRK) Contagious Interview campaign: BeaverTail and

Curate Feeds | Make Collections | Customize Email Briefs