As reported by The Hacker News, security researchers at OpenSourceMalware have identified 13 malicious npm packages delivering a previously undocumented JavaScript stealer dubbed WeaselBiscuit. The malware shares functional DNA with BeaverTail and OtterCookie — two strains linked to North Korea's Contagious Interview campaign — but represents a notable evolutionary step: smaller, self-contained, and stripped of the heavier capabilities that make its predecessors easier to detect.

Threat Alert: As reported by The Hacker News, security researchers at OpenSourceMalware have identified 13 malicious npm packages delivering a previously undocumented JavaScript stealer dubbed WeaselBiscuit.

Why the Stripped-Down Approach Matters

The most significant takeaway is not what WeaselBiscuit does, but what it deliberately doesn't do. By removing cryptocurrency wallet-draining code, persistence mechanisms, remote access functionality, and secondary payload delivery, the operators have reduced the malware's footprint substantially. This is a calculated trade-off: less capability means less telemetry for EDR and behavioral analytics to flag, while the core objective — harvesting Chrome extension storage — remains intact.

Chrome extension storage is an underappreciated attack surface. Many developers and cryptocurrency users store sensitive state — including wallet configuration, authentication tokens, and session data — in browser extensions that persist across sessions. WeaselBiscuit's focus on exfiltrating every readable, non-empty file under Chrome's extension storage directory means it can capture this data without needing wallet-specific logic. This is a broader and arguably more resilient approach than targeting individual wallet applications.

The threat actor's decision to remove complex functionality and focus on a single data source suggests an awareness that detection engineering has caught up to heavier malware families. Leaner is harder to catch.

Supply Chain Mechanics and Dead Drop Infrastructure

The infection chain is straightforward but effective: importing any of the 13 packages triggers a loader script that fetches the main payload from an Npoint URL — a legitimate file-sharing service — and executes it directly in memory. This in-memory execution approach leaves minimal forensic traces on disk. A second Npoint URL serves as the C2 configuration endpoint, allowing operators to rotate infrastructure without republishing packages.

The use of Npoint as a dead drop is particularly notable. Legitimate services like this are rarely blocked by default network policies, making them ideal for blending malicious traffic into normal web activity. The known C2 endpoint at 103.170.217[.]184:8787 should be treated as a high-priority IOC.

Malicious npm Packages Identified

  • @biz44/id10-client
  • @biz44/id12-client
  • @biz44/id44-client
  • @biz44/id79-client
  • @biz44/id95-client
  • @biz44/id99-client
  • @biz44/process-runtime-utils
  • @biz44/runtime-utils
  • engin1
  • id79-client
  • process-lhpm
  • process-mite
  • process-tailwind

Who Is Most at Risk

Software developers, IT professionals, and organizations with permissive npm dependency policies face the highest exposure. The @biz44 scoped packages follow a naming convention designed to appear legitimate, while packages like process-tailwind and engin1 exploit familiarity with common development tooling. Any environment that auto-installs dependencies without review — including CI/CD pipelines, container builds, and developer workstations with broad install permissions — is at risk.

Shield53 Recommendations

Immediate Actions

Who Is Most at Risk
Audit dependencies immediately: Search package-lock.json, yarn.lock, and npm-shrinkwrap.json files across all repositories for any of the 13 listed packages. Remove and quarantine any matches.
Block known IOCs: Add 103.170.217.184 to network blocklists and SIEM watchlists. Monitor for outbound connections to Npoint URLs from developer workstations and build servers.
Inspect Chrome extension storage: On potentially compromised machines, review ~/Library/Application Support/Google/Chrome/Default/Local Extension Settings/ (macOS), %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\ (Windows), or ~/.config/google-chrome/Default/Local Extension Settings/ (Linux) for unexpected access patterns.
Hunt for in-memory execution: Look for Node.js processes making outbound HTTP requests to Npoint endpoints, especially immediately after npm install or require() calls.

Longer-Term Hardening

  • Implement SLSA provenance verification for third-party packages and enforce allowlists for npm scopes in CI/CD pipelines.
  • Deploy runtime monitoring for Node.js processes in development environments — focus on unexpected network egress and file system access to browser profile directories.
  • Educate development teams on the Contagious Interview campaign pattern, which historically targets developers through fake job interviews and coding assessments. The npm supply chain vector is a natural extension of this social engineering playbook.
  • Consider browser extension isolation policies for developer workstations that handle sensitive credentials or cryptocurrency operations.

The emergence of WeaselBiscuit confirms that DPRK-linked actors are actively iterating on their tooling to stay ahead of detection. The trend toward leaner, more focused malware should prompt defenders to reconsider whether their detection strategies are overly reliant on catching complex behaviors — when the most dangerous attacks may now be the simplest ones.