"It's smaller, lighter, and stripped down, with many of the heavier functions removed entirely," security researcher Paul McCarty (aka 6mile) said.
WeaselBiscuit's design and distinguishing features
Researchers at OpenSourceMalware have identified a compact JavaScript stealer they have named WeaselBiscuit. The malware is described as a "stripped down stealer" that borrows functions from previously documented families but removes heavy capabilities: it lacks remote access, persistence, cryptocurrency wallet-draining code, and the ability to deliver secondary payloads such as InvisibleFerret. Instead, the family is intentionally small and self-contained and is triggered simply by importing an infected npm package.
Distribution via 13 npm packages
OpenSourceMalware found WeaselBiscuit distributed across 13 npm packages. The packages named in the report are:
- @biz44/id10-client
- @biz44/id12-client
- @biz44/id44-client
- @biz44/id79-client
- @biz44/id95-client
- @biz44/id99-client
- @biz44/process-runtime-utils
- @biz44/runtime-utils
- engin1
- id79-client
- process-lhpm
- process-mite
- process-tailwind
On import, the malicious package runs a loader ("loader.js") that pulls the main payload from an Npoint dead drop and executes it directly in memory — a delivery pattern that avoids writing a conventional executable to disk.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleExecution flow: Npoint dead drop, C2, and Chrome extension exfiltration
When executed, WeaselBiscuit resolves its command-and-control (C2) configuration from a separate Npoint URL, profiles the compromised host, and exfiltrates data it locates in Chrome extension storage across Windows, macOS, and Linux systems. According to Paul McCarty, the stealer "uploads every readable, nonempty file under the extension's Local Extension Settings directory — a raw LevelDB key/value store — wholesale."
The malware also supports operator commands from the C2 server identified in the report as "103.170.217[.]184:8787." Based on received commands, it can log clipboard contents and capture keystrokes on Windows hosts. The loader retrieves the main module by importing it from Npoint and then uses an externally resolved configuration to determine what to collect and where to send it.
Tradecraft overlaps with BeaverTail, OtterCookie, and earlier npm abuse
OpenSourceMalware notes "meaningful overlap with DPRK-associated Contagious Interview tooling" but cautions there is no definitive evidence tying WeaselBiscuit to North Korean operators in terms of infrastructure, victimology, campaign metadata, or signing material. Still, the report highlights multiple tradecraft signals that echo prior tooling:
- Functional similarities with BeaverTail (a cross-platform information-stealer and downloader reported active since at least late 2022) and OtterCookie (which pairs information-stealing with remote access capabilities and was first publicly documented by NTT Security Holdings in December 2024).
- The use of Npoint.io, a lightweight online JSON storage service, which NVISO flagged in November 2025 in connection with Contagious Interview activity.
- Nested public-IP and geolocation lookups via api.ipify.org and ip-api.com, and C2-architecture similarities that overlap with OtterCookie.
- The use of a numerical campaign ID (10, 12, 44, 79, 95, 99) to tag installs — a pattern that mirrors that used by PolinRider.
OpenSourceMalware's Jenn Gile summarized the project's reasoning: "It's a stripped down stealer that borrows several functions from DPRK's BeaverTail and OtterCookie, but is much smaller and self-contained." The report also notes an October 2025 Cisco Talos finding of an npm package named "node-nvm-ssh" that "had characteristics of BeaverTail and of OtterCookie, blurring the distinction between the two."
What this means for Chrome extension users, security teams, and package maintainers
Chrome extension users, including those who rely on wallet or credential-holding extensions, should be aware that WeaselBiscuit exfiltrates extension Local Extension Settings — a LevelDB key/value store that can contain sensitive state. As Paul McCarty explains, "the Chrome extension-storage capability is financially relevant: it can expose wallet-extension state or other extension-held sensitive data."
Security teams and technologists need to monitor dependencies: the malware activates via an npm import and pulls executable modules from external JSON storage. Detection strategies that focus solely on disk artifacts may miss the in-memory execution model described in the report.
Open-source package maintainers and procurement leaders should note the distribution vector — malicious code embedded in seemingly legitimate npm packages — and validate supply-chain controls for third-party modules and transitive dependencies.
OpenSourceMalware stresses that, despite technique overlaps with known DPRK-associated tooling, conclusive attribution is not present in the available telemetry. Whether WeaselBiscuit represents a new, narrower tool in the same adversary toolkit or an independent, copycat effort remains an open question; investigators and defenders will be watching the same signals that linked earlier campaigns — Npoint usage, public-IP lookups, campaign-ID tagging, and C2 architecture — for further evidence.
https://thehackernews.com/2026/09/weaselbiscuit-stealer-spreads-via-13.html
