Cybersecurity teams have discovered a new JavaScript-based information stealer dubbed WeaselBiscuitspreading through 13 malicious npm packages. The tool’s design pulls partial inspiration from two DPRK-linked malware families, BeaverTail and OtterCookie, though experts emphasize that WeaselBiscuit lacks several of their more advanced features. It appears optimized for lightweight execution and focused data harvesting.
These npm packages, all attributed to variations of “@biz44” and other similarly named modules like engin1, process-lhpm, process-tailwind, and id79-client, triggered concern after being shown to include a JS loader (“loader.js”) that retrieves the main malware from a public dead-drop service called Npoint. From there, WeaselBiscuit runs entirely in memory, avoiding persisting to disk.
Key Capabilities & Attack Profile
Once active, WeaselBiscuit reaches back to a command & control (C2) server (at 103.170.217[.]184:8787) to retrieve configuration settings. It collects system metrics, identifies installed Chrome extensions, and scoops up data stored under the extensions’ Local Extension Settings folder, which uses LevelDB. On Windows systems, it also monitors clipboard contents and keystrokes when instructed.
Absent are remote access tools, cryptocurrency wallet extraction, persistence mechanisms, or secondary-stage payload delivery. That marks a contrast with its BeaverTail and OtterCookie predecessors. In particular, OtterCookie combines info-stealing with remote access, while BeaverTail has functional breadth including downloader elements and crypto targeting. WeaselBiscuit, by contrast, has a stripped-down scope.
Links to DPRK Malware, But No Confirmed Attribution
Security researchers have flagged multiple traits that mirror those seen in North Korean (DPRK) threat actor toolkits—like BeaverTail and OtterCookie—yet there is no definitive proof that WeaselBiscuit is part of any known state-backed campaign. Similarities include use of Npoint.io for JSON storage, identical techniques for IP/geolocation lookups, overlapping C2 infrastructure design, and campaign tagging via numeric IDs (10, 12, 44, 79, 95, 99), which aligns with DPRK-associated malware trends.
Notably, earlier in 2025 a malicious npm package titled “node-nvm-ssh” was found to blur BeaverTail and OtterCookie features, suggesting a pattern where threat actors may be reusing or recombining toolkits. But as of now, no signing certificates, operator details, or victim profiles tie WeaselBiscuit explicitly to DPRK actors.
For developers and organizations, the primary takeaway is to vet npm dependencies carefully, especially lesser-known packages and those with unexpected third-party modules. Use code audits to check for import calls that may pull in malicious loader scripts, and monitor C2 communication attempts, as in this case.
Though WeaselBiscuit is not as powerful as BeaverTail or OtterCookie, its ability to harvest data from Chrome extension storage poses a serious risk. That storage can contain sensitive extension-held info—any or all of which may be exposed through WeaselBiscuit.
If security researchers can trace its infrastructure or victims, attribution may become clearer; meanwhile, defenders must treat this as a signal of evolving supply chain threats. Vigilance, dependency hygiene, and monitoring in npm ecosystems are no longer optional—they’re essential.
