A new JavaScript stealer tracked as WeaselBiscuit has been found distributed through 13 compromised npm packages, targeting sensitive data stored in Chrome extension storage. Researchers from OpenSourceMalware discovered the malware exhibits code similarities to BeaverTail and other tools linked to North Korea's Contagious Interview campaign, suggesting possible attribution to DPRK threat actors.
The attack chain works by injecting malicious code into legitimate npm packages. When developers download these packages as dependencies, the stealer executes during installation or runtime, extracting data from Chrome extension storage without user awareness. This technique targets credentials, API keys, authentication tokens, and other sensitive information that browser extensions store locally. WeaselBiscuit focuses specifically on harvesting this data from developer machines, build pipelines, and systems where sensitive extensions operate.
npm serves as the primary package repository for JavaScript and Node.js projects. The 13 identified packages leveraged this trust to reach developers across multiple projects. Once installed, WeaselBiscuit persists through various mechanisms and communicates stolen data to attacker-controlled command-and-control infrastructure. The scope of this campaign extends beyond individual developers to potentially compromise entire organizations when these packages integrate into production codebases.
The functional overlaps with BeaverTail point toward coordinated infrastructure or shared development methodologies among threat actors. BeaverTail targets Windows systems and steals browser cookies and extension data, while WeaselBiscuit specifically focuses on JavaScript execution environments. Both tools extract stored credentials, suggesting a coordinated effort to harvest authentication material across multiple attack surfaces. The connection to the Contagious Interview campaign indicates this represents part of a broader intelligence gathering operation attributed to North Korean threat actors.
The Contagious Interview campaign itself uses social engineering to trick security researchers and developers into downloading malicious tools through fake job interviews and recruiting sites. This new npm distribution method represents an evolution in the campaign's tactics, shifting from social engineering toward supply chain compromise. Developers now face risk not just from phishing but from seemingly legitimate open-source packages.
The npm ecosystem faces recurring supply chain attacks. Previous incidents included the ua-parser-js compromise, which delivered malware through a widely-used package. The WeaselBiscuit discovery underscores how attackers exploit the trust developers place in open-source repositories. npm's size and the difficulty of manual vetting make detection challenging. Automated scanning tools catch some threats, but novel malware families often bypass initial defenses.
Organizations should immediately audit their npm dependencies and check for the 13 identified packages. Developers should rotate any credentials stored in Chrome extensions, particularly API keys, authentication tokens, and service account credentials. Consider restricting npm package installations to verified sources and implementing stricter code review processes for dependency updates.
The broader implication extends to supply chain security. This incident demonstrates how open-source repositories serve as attack vectors for state-sponsored actors. Organizations must assume that downloaded packages may contain malicious code regardless of source reputation. Defense requires combination approaches: dependency scanning tools, behavioral monitoring, credential rotation, and limiting extension permissions to essential functions only.
npm has removed the identified malicious packages, but the incident's scope remains unclear. Determining how many systems downloaded these packages and extracting credentials from compromised machines presents ongoing challenges for affected organizations.