Full Report
Cybersecurity researchers have discovered a cluster of 13 npm packages that have been found to deliver a previously undocumented JavaScript stealer codenamed WeaselBiscuit. The new malware family, per OpenSourceMalware, exhibits functional overlaps with two malware strains associated with the Democratic People's Republic of Korea's (DPRK) Contagious Interview campaign: BeaverTail and
Analysis Summary
# Tool/Technique: WeaselBiscuit
## Overview
WeaselBiscuit is a lightweight JavaScript-based information stealer discovered in September 2026. It is distributed via malicious npm packages and is designed to harvest sensitive data from web browser extensions. While it shares functional overlaps with North Korean (DPRK) malware families like BeaverTail and OtterCookie, it is characterized by its "stripped-down" nature, focusing on stealthy data exfiltration rather than persistence or remote access.
## Technical Details
- **Type:** Malware family (Stealer/Loader)
- **Platform:** Windows, macOS, Linux (Cross-platform via Node.js/JavaScript)
- **Capabilities:** Host profiling, Chrome extension storage harvesting, Keylogging (Windows), Clipboard logging (Windows), In-memory execution.
- **First Seen:** September 2026
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1195.001 - Supply Chain Compromise: Malicious Tooling (via npm registry)
- **TA0002 - Execution**
- T1059.007 - Command and Scripting Interpreter: JavaScript
- **TA0007 - Discovery**
- T1082 - System Information Discovery
- T1016 - System Network Configuration Discovery
- **TA0009 - Collection**
- T1115 - Clipboard Data
- T1056.001 - Input Capture: Keylogging
- T1539 - Steal Web Session Cookie (Targeting extension Local Extension Settings)
- **TA0011 - Command and Control**
- T1102.001 - Web Service: Dead Drop Resolver (Use of Npoint.io)
- T1071.001 - Application Layer Protocol: Web Protocols
## Functionality
### Core Capabilities
- **Supply Chain Delivery:** Infiltrates environments through 13 specific npm packages (e.g., `@biz44/runtime-utils`).
- **Memory-Only Execution:** Uses a small loader (`loader.js`) to fetch the main payload from a dead-drop URL and executes it directly in memory to avoid disk-based detection.
- **Chrome Extension Harvesting:** Specifically targets the `Local Extension Settings` directory (LevelDB stores) to upload sensitive data, including crypto wallet states, wholesale.
- **Host Profiling:** Uses public APIs (`api.ipify.org`, `ip-api.com`) to determine the victim's IP and geolocation.
### Advanced Features
- **Dead Drop Configuration:** Leverages `Npoint.io` (a JSON storage service) to host its C2 configuration and main malware code, allowing attackers to update infrastructure without changing the malicious npm package.
- **OS-Specific Modules:** While cross-platform, it includes specialized modules for Windows to perform keylogging and clipboard monitoring.
- **Campaign Tracking:** Uses numerical ID tags (e.g., 10, 44, 99) in communications to track different infection vectors or campaigns.
## Indicators of Compromise
- **File Names:** `loader.js`
- **npm Packages:**
- `@biz44/id10-client` through `@biz44/id99-client`
- `@biz44/process-runtime-utils`
- `@biz44/runtime-utils`
- `engin1`, `id79-client`, `process-lhpm`, `process-mite`, `process-tailwind`
- **Network Indicators (Defanged):**
- C2 Server: `103.170.217[.]184:8787`
- Dead Drop: `npoint[.]io`
- IP/Geo Services: `api.ipify[.]org`, `ip-api[.]com`
- **Behavioral Indicators:**
- Node.js processes accessing Chrome's `Local Extension Settings` directory.
- Unexpected outbound connections from developer workstations to `npoint.io`.
## Associated Threat Actors
- **Contagious Interview (DPRK-Linked):** Strong functional and TTP overlap with North Korean activity, though definitive attribution is currently Caveated by researchers.
## Detection Methods
- **Signature-based detection:** Scanning npm `node_modules` for the specific package names listed above.
- **Behavioral detection:** Monitoring for Node.js processes that perform automated reads of sensitive browser directories (LevelDB files) or initiate keylogging hooks.
- **Network Monitoring:** Alerting on traffic to `npoint.io` originating from automated build scripts or developer environments.
## Mitigation Strategies
- **Supply Chain Security:** Use tools like `npm audit` and implement private registries with allowed-list capabilities.
- **Endpoint Hardening:** Restrict developer environments from accessing sensitive browser profile data where possible.
- **Content Security:** Implement egress filtering to block known dead-drop providers (like Npoint) and unauthorized C2 IPs.
## Related Tools/Techniques
- **BeaverTail:** A larger, cross-platform stealer/downloader with more robust features.
- **OtterCookie:** A stealer that includes remote access/command execution capabilities.
- **InvisibleFerret:** A secondary payload often delivered by BeaverTail/OtterCookie (notably absent in WeaselBiscuit).
- **PolinRider:** Shares similar campaign ID tagging conventions.