- Threat actors are distributing 13 malicious npm packages that deliver a new, lightweight JavaScript stealer named WeaselBiscuit.
- The malware shows functional overlaps with BeaverTail and OtterCookie, tools linked to North Korea’s Contagious Interview campaign, but lacks their advanced features like remote access and crypto-draining code.
- Despite the code similarities, researchers have not found definitive evidence to conclusively attribute this operation to North Korea based on infrastructure or other campaign metadata.
Cybersecurity researchers have uncovered a cluster of 13 npm packages that deliver a previously undocumented JavaScript stealer codenamed WeaselBiscuit, according to an analysis by OpenSourceMalware. The new malware family exhibits functional overlaps with two malware strains tied to the Democratic People’s Republic of Korea’s (DPRK) Contagious Interview campaign: BeaverTail and OtterCookie. “It’s smaller, lighter, and stripped down, with many of the heavier functions removed entirely,” security researcher Paul McCarty (aka 6mile) said.
The malicious packages include @biz44/id10-client, @biz44/id12-client, @biz44/id44-client, @biz44/id79-client, @biz44/id95-client, @biz44/id99-client, @biz44/process-runtime-utils, @biz44/runtime-utils, engin1, id79-client, process-lhpm, process-mite, and process-tailwind. BeaverTail is a cross-platform information-stealing malware and downloader used since at least late 2022 to target software developers, IT professionals, and cryptocurrency users. Meanwhile, OtterCookie combines information-stealing capabilities with remote access functionality, allowing operators to execute commands on compromised hosts.
Consequently, WeaselBiscuit stands out for its simplicity, lacking remote access, persistence, crypto wallet-draining code, and secondary payload delivery like InvisibleFerret. Instead, it triggers via an npm import, which prompts the loader (“loader.js”) to fetch the main malware from an Npoint dead drop and execute it directly in memory. Upon execution, it resolves its command-and-control (C2) configuration from a separate Npoint URL, profiles the infected host, and harvests Chrome extension storage across Windows, macOS, and Linux.
Based on operator commands from the C2 server (“103.170.217[.]184:8787”), it can also log clipboard contents and keystrokes on Windows machines. “While this malware does not have the same crypto wallet stealer functions as its big siblings, the Chrome extension-storage capability is financially relevant: it can expose wallet-extension state or other extension-held sensitive data,” McCarty explained. “It uploads every readable, nonempty file under the extension’s Local Extension Settings directory — a raw LevelDB key/value store — wholesale.”
Other tradecraft pointing to North Korea includes using Npoint.io, a lightweight online JSON storage service, and nested public-IP and geolocation lookups via api.ipify.org and ip-api.com. Similarities in C2 architecture overlap with OtterCookie, and the use of a numerical campaign ID (10, 12, 44, 79, 95, 99) mirrors that of PolinRider. However, OpenSourceMalware has emphasized that despite the “meaningful overlap with DPRK-associated Contagious Interview tooling,” there is no definitive evidence in terms of operator infrastructure, victimology, campaign metadata, or signing material to conclusively attribute it to North Korea.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
