Summary
- Researchers identified 13 npm packages delivering a JavaScript stealer named WeaselBiscuit.
- The malware activates on import and can harvest Chrome extension storage across Windows, macOS, and Linux.
- Researchers have identified similarities with DPRK-linked malware, but the North Korean attribution remains tentative rather than established.
A cluster of 13 malicious npm packages has been linked to a previously undocumented JavaScript information stealer capable of harvesting data stored by Chrome extensions across Windows, macOS, and Linux systems.
The malware, named WeaselBiscuit by researchers, is delivered through packages published to the npm ecosystem and begins executing when the package is imported rather than relying on an installation script.
Research published by OpenSourceMalware says the malware retrieves its second-stage payload from an external dead drop and runs it in memory. It can profile the compromised host, collect Chrome extension storage, and, on Windows systems, receive commands to capture clipboard contents and keystrokes.
The extension-storage capability is particularly relevant because browser extensions increasingly hold authentication state, cryptocurrency wallet information, enterprise workflow data, and other material outside the browser’s conventional password store.
Researchers identified functional similarities between WeaselBiscuit and BeaverTail and OtterCookie, malware associated with North Korea’s Contagious Interview activity. That is not the same as establishing that the same operators are responsible for WeaselBiscuit.
Public assessments describe the DPRK connection as a low-to-moderate-confidence hypothesis based on code and functional overlap. Researchers had not identified stronger attribution evidence such as common operator infrastructure, exclusive code, or matching victimology at the time of publication.
Keeping that distinction clear is important because reuse and imitation are common in malware development. An actor can copy functions from public or leaked code, adopt techniques associated with another group, or deliberately create misleading similarities. Shared capability is evidence to investigate, not proof of common control.
The package cluster does, however, overlap technically with a wider pattern of attacks aimed at developers through open-source ecosystems. Development machines often hold repository credentials, package-registry tokens, cloud identities, signing material, browser sessions, and access to internal collaboration services. Compromise at that point can create multiple routes into an employer or client.
The use of Chrome extension storage broadens that exposure further. The malware does not need every extension to contain a cryptocurrency wallet or password. Copying readable local extension data wholesale gives the operator an opportunity to inspect whatever sensitive state individual extensions have left available.
The runtime behaviour also reinforces a problem seen in other current npm campaigns. Package-security controls focused on installation events can miss code that waits until a module is imported or an application function is called. A clean installation sequence is therefore not evidence that a package will behave safely later.
The 13 identified package names should be treated as indicators of one observed cluster rather than a complete definition of the campaign. Malicious publishers can rapidly replace packages, namespaces, accounts, and external infrastructure once a set of names becomes public.
For enterprise environments, the more durable issue is the concentration of high-value identities on developer endpoints. Browser extension data, source-control tokens, package-manager credentials, and cloud sessions can coexist on the same machine, giving relatively compact malware an unusually broad set of opportunities even when it lacks the full remote-access capability of more elaborate backdoors.
