WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage
-
Cybersecurity researchers have uncovered a cluster of 13 npm packages being used to distribute a previously undocumented JavaScript stealer tracked as WeaselBiscuit.
According to OpenSourceMalware, the new malware family shows functional overlaps with two strains tied to the DPRK-linked Contagious Interview campaign: BeaverTail and additional tooling from that operation. The stealer's primary objective is harvesting data stored in Chrome extension storage, a target that can expose sensitive tokens and session data held by browser extensions.
Key points:
- 13 npm packages identified as part of the distribution cluster
- Payload is a JavaScript stealer named WeaselBiscuit
- The malware is previously undocumented
- Functional overlap observed with BeaverTail and another strain linked to Contagious Interview
- Contagious Interview is attributed to the DPRK
- Targeting focuses on Chrome extension storage
The overlap with known Contagious Interview tooling is notable, as it suggests either shared tooling, reused code, or an evolution of the campaign's arsenal rather than a fully independent operation.
If you maintain JavaScript or Node.js projects, review your dependency trees for unexpected or recently added packages, and treat extension storage data as sensitive material worth protecting.
Source: The Hacker News
Has anyone seen these npm packages in their own dependency audits, and how is your team handling third-party package vetting?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login