WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage
A new JavaScript stealer, dubbed WeaselBiscuit, is spreading through 13 npm packages and leverages similarities with DPRK-linked malware like BeaverTail and OtterCookie. This malware primarily targets Chrome extension storage, potentially exposing sensitive wallet data, and lacks features commonly found in its predecessors, such as cryptocurrency wallet draining and remote access. Despite the overlap with DPRK tooling, definitive attribution to North Korean operators remains inconclusive.
A new JavaScript stealer, named WeaselBiscuit, is rapidly spreading via 13 npm packages, presenting a significant risk to developers and users relying on these packages. The malware exhibits functional overlaps with two malware strains associated with the Democratic People's Republic of Korea's (DPRK) Contagious Interview campaign: BeaverTail and OtterCookie. Security researcher Paul McCarty (aka 6mile) described WeaselBiscuit as "smaller, lighter, and stripped down," lacking features like cryptocurrency wallet draining and remote access, which are common in its larger siblings.
WeaselBiscuit is triggered by importing a package, which then pulls the main malware from an Npoint dead drop and executes it directly in memory. Upon execution, it resolves its command-and-control (C2) configuration from a separate Npoint URL, profiles the compromised host, and harvests Chrome extension storage across Windows, macOS, and Linux. It also logs clipboard contents and keystrokes on Windows machines. The malware uploads every readable, nonempty file under the extension's Local Extension Settings directory — a raw LevelDB key/value store — wholesale.
Despite the functional similarities with BeaverTail and OtterCookie, and the use of Npoint.io (flagged by NVISO in November 2025), OpenSourceMalware has not yet definitively linked WeaselBiscuit to North Korean operators. Tradecraft signals, such as nested public-IP and geolocation lookup via api.ipify.org and ip-api.com, and similar C2 architecture to OtterCookie, suggest a possible connection, but further investigation is needed. The potential for exposure of sensitive wallet data through compromised Chrome extensions represents a significant risk.
Previous attempts to merge BeaverTail and OtterCookie functionality were also identified, such as the npm package "node-nvm-ssh" in October 2025, highlighting a persistent strategy by DPRK threat actors to combine capabilities.