Cybersecurity researchers have uncovered 13 npm packages that deliver a previously undocumented JavaScript stealer named WeaselBiscuit. According to OpenSourceMalware, the malware shares functional overlaps with BeaverTail and OtterCookie, two strains tied to North Korea's Contagious Interview campaign.

The packages include @biz44/id10-client, @biz44/id12-client, @biz44/id44-client, @biz44/id79-client, @biz44/id95-client, @biz44/id99-client, @biz44/process-runtime-utils, @biz44/runtime-utils, engin1, id79-client, process-lhpm, process-mite, and process-tailwind.

"It's a stripped down stealer that borrows several functions from DPRK's BeaverTail and OtterCookie, but is much smaller and self-contained," said Jenn Gile, co-founder of OpenSourceMalware. "Hence the 'WeaselBiscuit' name, because a weasel is smaller than an otter, and we can argue that biscuits are less fancy than cookies."

WeaselBiscuit lacks remote access, persistence, crypto wallet-draining code, and secondary payload delivery. It is triggered via an npm import, which causes loader.js to fetch the main malware from an Npoint dead drop and execute it in memory. It then resolves its command-and-control configuration from a separate Npoint URL, profiles the host, and harvests Chrome extension storage on Windows, macOS, and Linux. Based on operator commands from the C2 server (103.170.217[.]184:8787), it can also log clipboard contents and keystrokes on Windows.

"While this malware does not have the same crypto wallet stealer functions as its big siblings, the Chrome extension-storage capability is financially relevant: it can expose wallet-extension state or other extension-held sensitive data," said researcher Paul McCarty (aka 6mile). "It uploads every readable, nonempty file under the extension's Local Extension Settings directory - a raw LevelDB key/value store - wholesale."

OpenSourceMalware stressed there is no definitive evidence to conclusively attribute the malware to North Korea, despite meaningful overlap with DPRK-associated tooling. Tradecraft signals pointing to North Korea include the use of Npoint.io, nested public-IP and geolocation lookups via api.ipify.org and ip-api.com, C2 architecture similarities to OtterCookie, and numerical campaign IDs (10, 12, 44, 79, 95, 99) mirroring PolinRider.

If confirmed, this would not be the first time DPRK actors merged BeaverTail and OtterCookie features. In October 2025, Cisco Talos identified an npm package named "node-nvm-ssh" with characteristics of both.

Source: The Hackers News