WeaselBiscuit Stealer Hits npm Registry to Target Extension Data

Anatomy of a Modern Supply Chain Attack

The software ecosystem relied upon by modern web developers has once again become a battleground. Cybersecurity researchers have uncovered a newly identified cluster of malicious code infiltrating the npm registry—the primary package management system for Node.js and JavaScript applications. Dubbed "WeaselBiscuit," this novel JavaScript-based stealer was deployed through at least 13 compromised or deliberately crafted npm packages designed to look like legitimate software utilities.

While rogue packages on public registries are unfortunately common, WeaselBiscuit stands out due to its stealth, specialized targeting, and structural links to sophisticated nation-state actors. Rather than attempting a broad sweep of system files or personal documents, the malware zeroes in on browser extension storage, session tokens, and local data vaults associated with cryptocurrency wallets and browser extensions. By stealthily intercepting sensitive credentials at the application level, the operators behind WeaselBiscuit can quietly harvest critical access tokens without triggering traditional endpoint detection systems.

This incident highlights a persistent vulnerability in the modern software development pipeline: developers routinely import thousands of third-party dependencies into their codebases without exhaustive code reviews. When an attacker successfully seeds a malicious package into a public registry like npm, they gain a direct bridge into developer machines, corporate environments, and downstream end-user applications.

Unpacking WeaselBiscuit: How the Malware Operates

The delivery mechanism for WeaselBiscuit relies on classic typosquatting and deceptive branding within the JavaScript ecosystem. Attackers uploaded modules using names that closely mimicked popular libraries or offered seemingly useful developer shortcuts, such as helper functions for utility processing, network requests, or cryptographic operations. Once integrated into a project or installed locally on an engineer's machine, the malicious package executes obfuscated initialization scripts.

Unlike traditional infostealers written in compiled languages like C++ or Rust that target system registries and local disk paths, WeaselBiscuit operates almost entirely within the JavaScript environment. Its core module is engineered to analyze local directory structures and specifically target Google Chrome user profiles, Chromium-based browser variations, and application storage paths.

The primary objective of the stealer is to extract non-volatile browser storage, specifically focusing on:

• Chrome Extension Storage Local Files: Extracting key-value pairs stored by security extensions, authentication tools, and identity providers.
• Browser IndexedDB and LevelDB Databases: Scraping stored state data, session cookies, and persistent tokens used by web applications.
• Cryptocurrency Wallet Extensions: Target-seeking routines designed to locate and exfiltrate seed phrases, private keys, and encrypted key vaults managed by browser-based wallets.

Once the target data is compiled, WeaselBiscuit compresses and encodes the stolen assets. It then uses HTTPS POST requests or WebSocket connections to transmit the payload to command-and-control (C2) infrastructure disguised as legitimate web APIs or cloud endpoints. By leveraging standard web protocols and common JavaScript constructs, the exfiltration traffic easily blends in with typical developer network activity.

Ties to the Contagious Interview Campaign

Security analysts at OpenSourceMalware and independent threat research groups noted significant functional and structural overlap between WeaselBiscuit and previously documented threat tools. Most notably, the code structure, obfuscation techniques, and C2 communication protocols bear striking similarities to BeaverTail, an infostealer previously associated with cyber activity originating from the Democratic People's Republic of Korea (DPRK).

Historically, DPRK-linked threat actors have engaged in widespread social engineering initiatives often categorized under the umbrella of the "Contagious Interview" campaign. In these operations, threat actors impersonate recruiters, engineering managers, or potential clients on professional networking platforms like LinkedIn. They contact software engineers and offer job opportunities, consulting gigs, or technical code challenges.

As part of the screening process, the target is asked to download a source repository, build a sample application, or review a codebase hosted on platforms like GitHub. Unknown to the candidate, the project contains malicious dependencies—or direct calls to rogue npm packages—that silently deploy stealth malware onto the developer's workstation the moment npm install or npm run dev is executed. The discovery of WeaselBiscuit across 13 distinct npm packages indicates an expansion of this supply chain strategy, allowing attackers to compromise developers passively through registry searches in addition to active social engineering outreach.

Why Chrome Extension Storage is a Prime Target

The decision to prioritize browser extension storage marks a calculated evolution in credential theft strategies. Traditionally, infostealers targeted stored passwords saved directly within browser password managers or grabbed local cookies to hijack web sessions. However, the industry-wide push toward Multi-Factor Authentication (MFA) and single sign-on (SSO) platforms has forced attackers to adapt.

Modern developers and enterprise employees heavily rely on browser extensions for identity management, developer tooling, and security access. Browser extension storage—managed via the WebExtensions API using chrome.storage.local or chrome.storage.sync—often holds high-value data, including:

1. Hardware Security Key State Tokens: Temporary passkey markers and session tokens stored by zero-trust access extensions.
2. Developer Credentials: API keys, AWS credentials, and access tokens stored by cloud management tools embedded in the browser.
3. DeFi and Web3 Keys: Unencrypted or cached session keys for browser-native cryptocurrency wallets.

Because Chrome isolates extension storage on a per-extension basis using internal directory structures, end users rarely audit these files directly. Security software frequently whitelists standard browser data directories to avoid performance bottlenecks or false positives. WeaselBiscuit takes advantage of this blind spot, extracting raw storage files directly from the disk path associated with Chrome profiles before security engines can flag the abnormal access.

The Broader Impact on Software Supply Chain Security

The discovery of WeaselBiscuit underscores a fundamental architectural vulnerability in the open-source software supply chain. Package managers like npm, PyPI, and RubyGems have democratized software creation, allowing developers to build complex applications in record time. However, this model relies heavily on implicit trust.

When a developer installs a third-party module, that code typically runs with the full privilege level of the user executing the command. In a local environment, an npm post-install script can read local environment variables, access file directories, read SSH keys, and inspect running processes. In automated CI/CD pipelines, a compromised package can infect production builds, leak build-time environment secrets, or introduce backdoors into commercial software releases.

Despite ongoing efforts by open-source registry maintainers to introduce mandatory multi-factor authentication for package publishers, automated security scanning, and provenance tracking (such as Sigstore and npm audit features), threat actors continue to find clever bypasses. Obfuscation techniques, dynamic evaluation methods (such as eval() or Function() calls), and delayed execution timers routinely allow malicious packages to pass automated registry checks upon upload.

Mitigation Strategies for Developers and Enterprises

Defending against stealth infostealers like WeaselBiscuit requires a multi-layered security strategy that spans developer workstations, build pipelines, and identity management policies. Organizations and individual software engineers should implement several defensive measures:

• Restrict Lifecycle Scripts: Disable automatic lifecycle scripts in open-source registries unless explicitly required. Developers can run npm install --ignore-scripts by default to prevent rogue packages from executing code during installation.
• Implement Package Lock Verification and Pinning: Always commit package-lock.json or yarn.lock files to version control, ensuring exact hashes and versions are locked across all development environments.
• Utilize Private Registry Proxies: Enterprise environments should route dependency downloads through internal artifact repositories (such as Sonatype Nexus or JFrog Artifactory) that perform deep static analysis and dependency firewall checks prior to developer consumption.
• Adopt Least-Privilege Development Environments: Run development workflows, code evaluation, and candidate coding challenges inside isolated sandboxes, containers, or ephemeral virtual machines rather than directly on native workstation operating systems.
• Audit Browser Extension Environments: Implement enterprise group policies to restrict which browser extensions can be installed on corporate devices. Frequently clear extension cache data and require hardware-backed MFA keys that cannot be easily stolen via browser file exfiltration.

What Lies Ahead

As registry maintainers work to purge the remaining infrastructure connected to WeaselBiscuit, the episode serves as a sobering reminder of the changing landscape of cyber risk. Threat actors are no longer relying solely on direct network breaches; instead, they are targeting the soft underbelly of the technology sector: the trusted developer tools and open-source packages that power modern digital services.

Until package managers adopt stricter default execution policies and developers treat third-party dependencies with the same security scrutiny as untrusted binary downloads, malware families like WeaselBiscuit will continue to find fertile ground in the global software supply chain. Continuous vigilance, strict sandbox isolation, and automated dependency auditing are no longer optional—they are essential safeguards for modern engineering teams.