AI-generated editorial illustration; not a documentary photograph.
Security researchers have identified 13 npm packages that deliver WeaselBiscuit, a previously undocumented JavaScript information stealer. According to The Hacker News on September 18, 2026, the malware activates when an affected package is imported and targets Chrome extension storage on Windows, macOS and Linux.
Packages Used as Loaders
The affected packages include eight packages under the @biz44 scope and five unscoped packages: engin1, id79-client, process-lhpm, process-mite and process-tailwind. Their loader retrieves the main malware from an Npoint-hosted location and runs it directly in memory. WeaselBiscuit then obtains its command-and-control configuration from a separate Npoint URL and profiles the compromised computer.
Extension Data at Risk
OpenSourceMalware found that WeaselBiscuit collects readable, nonempty files from Chrome's Local Extension Settings directories. Those directories contain LevelDB data maintained by installed extensions, potentially including sensitive state held by cryptocurrency wallet extensions and other add-ons.
The stealer can also receive commands from its control server. On Windows, those commands can enable clipboard monitoring and keystroke logging. Researchers said the malware does not include remote-access functionality, persistence, cryptocurrency wallet-draining code or the ability to install secondary payloads.
DPRK Link Remains Unconfirmed
Researchers observed functional and infrastructure similarities to BeaverTail and OtterCookie, malware families associated with the DPRK-linked Contagious Interview campaign. The overlaps include use of Npoint.io, public IP and geolocation services, a comparable command-and-control design and numerical campaign identifiers attached to installations.
OpenSourceMalware cautioned that these similarities do not establish who operated WeaselBiscuit. The researchers reported no conclusive overlap in operator infrastructure, victims, campaign metadata or signing material, leaving attribution to North Korea unproven.
Source: WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage
SIGNAL TITANS
Leave a Reply