According to OpenSourceMalware, the new malware family shows functional overlaps with two strains tied to the DPRK-linked Contagious Interview campaign: BeaverTail and additional tooling from that operation. The stealer's primary objective is harvesting data stored in Chrome extension storage, a target that can expose sensitive tokens and session data held by browser extensions.

Key points:

• 13 npm packages identified as part of the distribution cluster
• Payload is a JavaScript stealer named WeaselBiscuit
• The malware is previously undocumented
• Functional overlap observed with BeaverTail and another strain linked to Contagious Interview
• Contagious Interview is attributed to the DPRK
• Targeting focuses on Chrome extension storage

The overlap with known Contagious Interview tooling is notable, as it suggests either shared tooling, reused code, or an evolution of the campaign's arsenal rather than a fully independent operation.

If you maintain JavaScript or Node.js projects, review your dependency trees for unexpected or recently added packages, and treat extension storage data as sensitive material worth protecting.

Source: The Hacker News

Has anyone seen these npm packages in their own dependency audits, and how is your team handling third-party package vetting?