A Stripped-Down Stealer, Not a New Family From Scratch
Researchers at OpenSourceMalware have identified a new JavaScript stealer, codenamed WeaselBiscuit, distributed through 13 malicious npm packages. Security researcher Paul McCarty, who flagged the campaign, described it as a deliberately minimized build: "It's smaller, lighter, and stripped down, with many of the heavier functions removed entirely."
That minimalism doesn't mean it's unsophisticated — it means the operators kept only what they needed for a specific job: raiding browser extension storage.
The 13 Packages
The malware shipped inside the following npm packages:
@biz44/id10-client@biz44/id12-client@biz44/id44-client@biz44/id79-client@biz44/id95-client@biz44/id99-client@biz44/process-runtime-utils@biz44/runtime-utilsengin1id79-clientprocess-lhpmprocess-miteprocess-tailwind
The numerical suffixes on the @biz44/id*-client packages (10, 12, 44, 79, 95, 99) appear to function as campaign IDs, suggesting operators tracked multiple concurrent distribution waves rather than a single one-off drop.
What It Targets
WeaselBiscuit's primary objective is Chrome extension storage, harvested across Windows, macOS, and Linux. It uploads the LevelDB key/value stores found in an extension's Local Extension Settings directory — the same on-disk storage many crypto wallet extensions and password-adjacent tools use to persist state. That makes extension-held wallet data and other sensitive settings a prime target, independent of whatever the host browser session itself is doing.
On Windows, the stealer additionally logs keystrokes and clipboard contents.
Attribution Signals
No group has been formally attributed, but several technical indicators point toward the Contagious Interview campaign cluster associated with North Korean threat activity:
- Functional overlaps with the BeaverTail and OtterCookie malware families
- Use of Npoint.io as a JSON-based dead-drop storage service for pulling additional payloads directly into memory
- C2 architecture patterns comparable to prior Contagious Interview tooling
- The systematic numerical campaign-ID tagging described above
The stealer's C2 server was identified at 103.170.217[.]184:8787, from which it can also receive and execute operator commands and perform basic system profiling of infected hosts.
Remediation
- Audit
package.jsonand lockfiles across your projects for any of the 13 packages listed above and remove them immediately if present - Treat any host that installed one of these packages as potentially compromised — rotate credentials for crypto wallet extensions and any secrets accessible from the browser profile on that machine
- Block outbound traffic to
103.170.217[.]184:8787and monitor for connections tonpoint.iofrom build or developer environments where it isn't expected - As with any npm supply-chain incident, prefer lockfile-pinned, audited dependencies and be wary of newly published or low-download-count packages, especially ones mimicking internal-sounding naming conventions like
@biz44/*