WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage

Summary

A new JavaScript stealer, dubbed WeaselBiscuit, has been discovered distributed through 13 npm packages. This stealer shares functional similarities with North Korean malware strains BeaverTail and OtterCookie, though it is a stripped-down version. It targets Chrome extension storage to harvest sensitive data and can also log keystrokes and clipboard contents on Windows systems.

Full text

WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage Ravie LakshmananSep 18, 2026Malware / Web Security Cybersecurity researchers have discovered a cluster of 13 npm packages that have been found to deliver a previously undocumented JavaScript stealer codenamed WeaselBiscuit. The new malware family, per OpenSourceMalware, exhibits functional overlaps with two malware strains associated with the Democratic People's Republic of Korea's (DPRK) Contagious Interview campaign: BeaverTail and OtterCookie. "It's smaller, lighter, and stripped down, with many of the heavier functions removed entirely," security researcher Paul McCarty (aka 6mile) said. The names of the packages are below - @biz44/id10-client @biz44/id12-client @biz44/id44-client @biz44/id79-client @biz44/id95-client @biz44/id99-client @biz44/process-runtime-utils @biz44/runtime-utils engin1 id79-client process-lhpm process-mite process-tailwind "It's a stripped down stealer that borrows several functions from DPRK's BeaverTail and OtterCookie, but is much smaller and self-contained," Jenn Gile, co-founder of OpenSourceMalware, said in a statement shared with The Hacker News. "Hence the 'WeaselBiscuit' name, because a weasel is smaller than an otter, and we can argue that biscuits are less fancy than cookies." BeaverTail is the name assigned to a cross-platform information-stealing malware and downloader operated by North Korean threat actors behind Contagious Interview to target software developers, IT professionals, and cryptocurrency users. The malware has been active since at least late 2022. On the other hand, OtterCookie combines information-stealing capabilities with remote access functionality that allows the operators to execute commands on compromised hosts. The malware was first publicly documented by NTT Security Holdings in December 2024. WeaselBiscuit is notable for its simplicity, lacking remote access, persistence, cryptocurrency wallet-draining code, and the ability to deliver secondary payloads like InvisibleFerret. Instead, it's triggered via an npm import, which causes the loader ("loader.js") to pull the main malware from an Npoint dead drop and execute it directly in memory. Upon execution, it resolves its command-and-control (C2) configuration from a separate Npoint URL, profiles the compromised host, and harvests Chrome extension storage across Windows, macOS, and Linux. Based on operator commands received from the C2 server ("103.170.217[.]184:8787"), it can also log clipboard contents and keystrokes on Windows machines. "While this malware does not have the same crypto wallet stealer functions as its big siblings, the Chrome extension-storage capability is financially relevant: it can expose wallet-extension state or other extension-held sensitive data," McCarty explained. "It uploads every readable, nonempty file under the extension's Local Extension Settings directory — a raw LevelDB key/value store — wholesale." OpenSourceMalware has emphasized that despite the "meaningful overlap with DPRK-associated Contagious Interview tooling," there is no definitive evidence in terms of operator infrastructure, victimology, campaign metadata, or signing material to conclusively attribute it to North Korea. Other tradecraft signals that point to North Korea are as follows - The use of Npoint.io, a lightweight online JSON storage service, an aspect that was flagged by NVISO in November 2025 in connection with Contagious Interview The use of nested public-IP and geolocation lookup via api.ipify.org and ip-api.com Similarities in C2 architecture that overlap with OtterCookie The use of a numerical campaign ID (10, 12, 44, 79, 95, 99) to tag each install, mirroring that of PolinRider If WeaselBiscuit does turn out to be the latest addition to DPRK's malware arsenal, this wouldn't be the first time the threat actors have attempted to merge the features of BeaverTail and OtterCookie. In October 2025, Cisco Talos said it identified an npm package named "node-nvm-ssh" that "had characteristics of BeaverTail and of OtterCookie, blurring the distinction between the two." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Malware, Supply Chain, Web Security ⚡ Top Stories This Week OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure Claude Used to Automate Exploitation and Data Theft Across Multiple Victims Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6 Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks When the Whole Company Adopts AI: What It Does to Your SOC Your Critical Vulnerabilities Might Not Be Your Biggest Risk What It Took to Reach 1 Billion Build Manifests US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries Why Are So Many Security Professionals Keeping Breaches Quiet? The Economics of Dwell Time and Why AI Native SIEM Changes the Equation ⭐ Featured Resources Get the eBook: Map Enterprise AI Risk Across the Full Lifecycle Give SOC Analysts Visibility Into 90% of Attacks Within 60 Seconds Benchmark Your SOC's AI Adoption With the 2026 Security Operations Report Register for LDR516: Strategic Vulnerability and Threat Management at SANS DC Metro

Indicators of Compromise

• ip — 103.170.217.184
• domain — npoint.io
• domain — api.ipify.org
• domain — ip-api.com

Entities