npm malware steals Chrome extension data from 13 packages

A new batch of npm malware, 13 packages in total, is being used to spread a previously undocumented JavaScript stealer that the research group OpenSourceMalware has named WeaselBiscuit. npm is the public package registry that JavaScript and Node.js developers use to pull ready-made code libraries into their projects, and anyone who installs one of the affected packages runs the attackers' code on their own computer.

The 13 package names reported by OpenSourceMalware are @biz44/id10-client, @biz44/id12-client, @biz44/id44-client, @biz44/id79-client, @biz44/id95-client, @biz44/id99-client, @biz44/process-runtime-utils, @biz44/runtime-utils, engin1, id79-client, process-lhpm, process-mite and process-tailwind. This is a supply chain attack in the simplest sense: nothing has to be hacked, because the malicious code sits in a library that a developer chooses to download, and it then runs with the developer's own permissions.

The chain begins with a single import statement. Adding one of these packages to a project and importing it causes a loader file, loader.js, to run. That loader fetches the main malware from a dead drop hosted on Npoint, a lightweight online service for storing JSON data, and executes it straight in memory instead of saving it to disk. Running in memory makes the code harder to spot with ordinary file scanning. Once active, the program resolves its command-and-control (C2) configuration from a second Npoint URL. A C2 server is a remote machine that malware contacts to receive orders. The stealer then profiles the infected host, gathering details about the machine, and harvests Chrome extension storage on Windows, macOS and Linux.

Chrome extension storage is the private data area where browser add-ons keep their settings and saved state, including any logins or wallet information a particular add-on holds. Paul McCarty, the security researcher also known as 6mile, explained that even without the cryptocurrency theft tools found in the malware's larger relatives, this capability has real financial value, because it can expose the saved state of a wallet extension or other sensitive data stored by an add-on. He described it as uploading every readable, non-empty file under the extension's Local Extension Settings directory, which is a raw LevelDB key and value store, in one go. Depending on the commands the operators send from the C2 server at 103.170.217[.]184:8787, the malware can also record clipboard contents and keystrokes on Windows machines.

What stands out to the researchers is how little WeaselBiscuit does. It has no remote access function, no persistence mechanism to survive a restart, no cryptocurrency wallet draining code, and no ability to deliver follow-up payloads such as InvisibleFerret, which are the extra tools some stealers drop onto a machine after the first stage. McCarty described it as smaller, lighter and stripped down compared with its relatives, with many of the heavier functions removed entirely. Jenn Gile, co-founder of OpenSourceMalware, said in a statement that the code borrows several functions from two known malware families but is far smaller and self-contained, and that this is where the name comes from, since a weasel is smaller than an otter and biscuits are less fancy than cookies.

The two families it borrows from are BeaverTail and OtterCookie, both associated with the Contagious Interview campaign, which OpenSourceMalware links to the Democratic People's Republic of Korea. BeaverTail is the name given to a cross-platform information-stealing malware and downloader that has been used since at least late 2022 against software developers, IT professionals and cryptocurrency users. OtterCookie pairs information theft with remote access, letting its operators run commands on an infected machine, and was first publicly documented by NTT Security Holdings in December 2024.

Despite the clear overlap with that tooling, OpenSourceMalware has stressed that nothing in the evidence so far settles the question of who is behind WeaselBiscuit. In its words, there is no definitive proof in the operator infrastructure, the victimology, the campaign metadata or the signing material that would conclusively attribute the malware to North Korea. That distinction matters: functional similarity between two pieces of code can come from shared source, copied code or a deliberate imitation, and it is not the same thing as proof of authorship.

The researchers point to several tradecraft signals that would fit the same picture. The use of Npoint.io was flagged by NVISO in November 2025 in connection with Contagious Interview activity. The malware performs nested lookups of public IP addresses and geolocation through api.ipify.org and ip-api.com. Its C2 architecture resembles that of OtterCookie. And each install is tagged with a numerical campaign ID from the set 10, 12, 44, 79, 95 and 99, mirroring a pattern seen with PolinRider. These are the same numbers embedded in several of the package names.

If WeaselBiscuit is eventually confirmed as part of that arsenal, it would not be the first attempt to merge features from the two older families. In October 2025, Cisco Talos said it had identified an npm package named node-nvm-ssh that carried characteristics of both BeaverTail and OtterCookie, blurring the line between them.

For website owners, agencies and IT teams, the practical lesson is about where code comes from. Build tools, themes, plugins and internal scripts routinely pull in packages from public registries, and each package is code that runs on a developer's laptop, a build server or a hosting account with whatever access that account has. A stealer that reads browser add-on data is also a reminder of how much sensitive material sits in ordinary workstations rather than in a central, monitored system. Teams that want help reviewing how software reaches their machines and servers, and how their development pipeline is set up, can look at AEU-I, which provides security-first IT, infrastructure and consulting. The details of that service are published at aeu-i.com.

The incident is not connected to a flaw in Chrome itself, and it does not involve a bug that a vendor can patch in the usual way. The risk is removed by not installing the affected packages and by removing them where they are already present, which is why OpenSourceMalware published the full list of names rather than only a description of the malware.