New WeaselBiscuit JavaScript Stealer Discovered in npm Packages

• •WeaselBiscuit spreads via 13 malicious npm packages.
• •The malware has similarities with DPRK's BeaverTail and OtterCookie but is simpler.
• •It can harvest Chrome extension storage and log clipboard contents on Windows.

Cybersecurity researchers identified a new JavaScript stealer named WeaselBiscuit, which spreads through 13 malicious npm packages. This malware is believed to have functional overlaps with DPRK-associated strains BeaverTail and OtterCookie but is smaller and lacks certain advanced features. It operates by executing a loader script upon npm import, fetching its payload from an Npoint URL and running it in memory. The malware profiles the host system and can harvest Chrome extension storage across multiple operating systems. While it can log clipboard contents and keystrokes on Windows, it does not possess the same capabilities for draining cryptocurrency wallets as its predecessors. OpenSourceMalware has tentatively attributed this malware to DPRK, but definitive evidence linking it to North Korean operators is still lacking. The discovery highlights a new threat vector targeting developers and cryptocurrency users.