WeaselBiscuit Stealer Spreads via npm Packages Targeting Chrome Extensions

Researchers have uncovered a cluster of 13 npm packages that deliver a previously undocumented JavaScript stealer code‑named WeaselBiscuit. According to OpenSourceMalware, the malware family exhibits functional overlaps with two strains associated with the Democratic People's Republic of Korea’s Contagious Interview campaign—BeaverTail and an unnamed second variant.¹

The stealer specifically targets Chrome extension storage APIs, suggesting an interest in harvesting cryptocurrency wallet keys or other sensitive data kept within browser extensions. Similar attacks have employed keyloggers and form grabbers to steal credentials directly from web browsers like Firefox. The DPRK connection warrants close monitoring given Operation Blockbuster (2017) involved widespread financial theft attributed to North Korean actors operating overseas. This attack highlights how seemingly innocuous development tools can be exploited by threat groups when developers do not apply proper security procedures during package selection and dependency management processes.¹

Use of npm packages as a distribution vector is increasingly common. Early 2026 saw 'Lightsnare' malware families use similar tactics to steal cryptocurrency wallets. The fact that this stealer overlaps with DPRK-attributed campaigns suggests potential collaboration or shared tooling within threat actor communities—it leverages browser extension storage APIs which are often poorly secured and contain sensitive data such as API keys and session cookies. A key indicator might be checking for unusual network traffic patterns originating from compromised systems attempting communication back to North Korea's infrastructure, though attribution remains difficult.¹