WeaselBiscuit , a new JavaScript stealer , has been discovered by cybersecurity researchers and is being distributed via 13 malicious npm packages with the aim of stealing data from Chrome extension repositories . The new malware shows significant functional similarities to two known tools linked to North Korea ’s Contagious Interview campaign : BeaverTail and OtterCookie . This discovery is of particular concern to the cybersecurity community, as it directly targets software developers and cryptocurrency users.
The package names are listed below –
- @biz44/id10-client
- @biz44/id12-client
- @biz44/id44-client
- @biz44/id79-client
- @biz44/id95-client
- @biz44/id99-client
- @biz44/process-runtime-utils
- @biz44/runtime-utils
- engine1
- id79-client
- process-lhpm
- process-mite
- process-tailwind
According to the OpenSourceMalware, WeaselBiscuit is a “lighter” and more compact tool than its “siblings.” Researcher Jenn Gile, co-founder of OpenSourceMalware, explained: “It’s a stripped-down stealer that borrows a lot of functionality from DPRK’s BeaverTail and OtterCookie, but is much smaller and more self-contained.” Security researcher Paul McCarty (aka 6mile) added that the malware is “smaller, lighter, and stripped down, with many of the heavier features completely removed.”
BeaverTail is a cross-platform infostealer and downloader used by North Korean threat actors to target software developers, IT professionals, and cryptocurrency users. The malware has been active since at least late 2022. OtterCookie , on the other hand, combines information-stealing capabilities with remote access functionality, allowing operators to execute commands on compromised systems. This malware was first publicly documented by NTT Security Holdings in December 2024 .
See also: PhantomRaven: npm Stealer was built with AI by a bug bounty hunter
How WeaselBiscuit Stealer works technically
WeaselBiscuit stands out for its simplicity. It does not have remote access capabilities, persistence mechanisms , code to empty crypto wallets , nor the ability to deliver secondary payloads like InvisibleFerret . Instead, it is activated via an npm import , which causes the loader ( loader.js ) to pull the main malware from an Npoint dead drop and execute it directly in memory , thus avoiding detection by traditional antivirus tools.
During execution, WeaselBiscuit resolves the C2 (Command and Control) configuration from a separate Npoint URL , profiles the compromised system, and collects Chrome extension storage on Windows , macOS , and Linux . Based on the commands it receives from the C2 server ( 103.170.217[.]184:8787 ), it can also record clipboard content and keystrokes on Windows machines. The use of Npoint.io — a lightweight online JSON storage service — was previously flagged by NVISO in November 2025 in connection with the Contagious Interview campaign .
Of particular concern is WeaselBiscuit’s ability to steal data from Chrome’s extension storage. As McCarty explained: “While this malware doesn’t have the same crypto wallet-stealing capabilities as its larger siblings, the Chrome extension-storage feature is economically relevant: it can expose wallet-extension state or other sensitive data held in extensions. It uploads every readable, nonempty file under the Local Extension Settings extension’s LevelDB key/value store.”
WeaselBiscuit and the North Korea connection
OpenSourceMalware noted that despite “significant overlap with tools associated with the Contagious Interview ’s DPRK,” there is no definitive evidence in terms of operator infrastructure, victimology, campaign metadata, or signature material to definitively attribute it to North Korea. However, there are several signs pointing to North Korean threat actors.
See also: 'ClickLock Stealer' bypasses macOS security
Among the clues linking WeaselBiscuit to North Korea are: the use of Npoint.io for dead drop — a tactic that has been linked to the Contagious Interview — the use of nested public IP lookups and geolocation via api.ipify.org and ip-api.com, similarities in C2 that overlap with OtterCookie , and the use of a numeric campaign ID (10, 12, 44, 79, 95, 99).
It’s worth noting that if WeaselBiscuit turns out to be the latest addition to the DPRK ’s malware arsenal , it wouldn’t be the first time threat actors have attempted to merge features of BeaverTail and OtterCookie . In October 2025 , Cisco Talos spotted an npm package named node-nvm-ssh that “ had features of both BeaverTail and OtterCookie, blurring the distinction between the two .”
How to protect yourself from WeaselBiscuit and similar threats
WeaselBiscuit's discovery highlights the importance of software supply chain security.Developers and organizations using npm packages should be especially careful. Specifically, it is recommended to use dependency scanning before installing any package, check the reputation and history of packages in the npm registry, and implement a principle of least privilege in development environments.
See also: ACR Stealer: New campaigns steal Microsoft 365 tokens and files
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Additionally, users who use Chrome to manage crypto wallets or other sensitive data should be aware that the storage space of these extensions (Local Extension Settings) is now a target for malware. Using hardware wallets instead of software wallets, changing passwords regularly, and enabling multi-factor authentication (MFA) on all accounts are key protection measures. Organizations should also implement network monitoring to detect suspicious communications with known C2 addresses.
