WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage

A new JavaScript stealer named WeaselBiscuit has been distributed through 13 malicious npm packages, targeting developers by harvesting Chrome extension storage data. The malware is lightweight and memory-resident, importing and executing its payload from an Npoint.io dead drop. It communicates with a C2 server at 103.170.217.184:8787 to receive commands and exfiltrate data, including clipboard contents and keystrokes on Windows. While it shares functional and tradecraft similarities with DPRK-linked malware BeaverTail and OtterCookie, no definitive attribution has been made.

AI-extracted · verify before operational use