WeaselBiscuit npm Stealer Hijacks 13 Packages to Exfiltrate Chrome Data

WeaselBiscuit npm Threat Spreads via ↓ 13 Packages

WeaselBiscuit npm is a newly catalogued JavaScript stealer that infiltrates developers through a chain of thirteen npm modules, siphoning Chrome extension storage for unknown actors.

Security analysts at OpenSourceMalware traced the code to a modular framework that mirrors components of the DPRK‑linked BeaverTail and Contagious Interview campaigns, suggesting state‑sponsored origins.

“We observed the payload pulling Chrome extension storage within seconds,” said a researcher.

The malicious packages masquerade as utility libraries, each pulling a tiny dependency that collectively assembles the full exfiltration engine. Once installed, the code executes silently in the browser context, harvesting Reuters-cited data such as saved passwords and tokens.

Defenders are urged to audit their supply chains and enforce strict version pinning, especially after the pandemic highlighted the fragility of remote development pipelines.

Intel provided by Leo Carmichael (Special Assignments Reporter).
(Note: Leo Carmichael is covering this desk while Kaelen Frost is on annual vacation.)