WeaselBiscuit Malware Hidden in 13 npm Packages Targets Chrome Extension Data

Introduction

The digital ecosystem relies heavily on open‑source libraries to accelerate development, but this convenience also opens doors for malicious actors. Recent research has exposed a hidden threat: a JavaScript stealer named WeaselBiscuit that has been silently distributed through 13 different npm packages. These packages, once added to a project, harvest sensitive information stored within Chrome extensions, potentially exposing user credentials, session tokens, and configuration data. The find, reported by the OpenSourceMalware collective, underscores the importance of vigilance when selecting dependencies and reinforces the need for robust security scanning practices.

What makes WeaselBiscuit particularly noteworthy is its functional resemblance to other malware families linked to the Democratic People's Republic of Korea's (DPRK) Contagious Interview campaign, notably BeaverTail. While the exact attribution remains under investigation, the overlapping techniques suggest a coordinated effort by a sophisticated threat actor seeking to monetize stolen extension data. As we delve deeper into the mechanics of this stealer, we will explore how it operates, the potential impact on both developers and end‑users, and the defensive steps that can mitigate such risks.

New JavaScript Stealer Identified Across Multiple npm Packages

Security analysts discovered the malicious code after monitoring suspicious network traffic emanating from a handful of npm registries. The investigation traced the origin to a set of 13 packages that, on the surface, offered legitimate functionality—ranging from utility libraries to UI components. However, each package contained a hidden payload that activated when the code executed in a browser environment.

• Upon inclusion, the payload registers a global event listener that captures DOM changes related to extension storage APIs.
• It systematically queries the chrome.storage namespace, extracting both sync and local storage entries.
• The harvested data is then encoded and transmitted to remote servers controlled by the attackers.

The distribution method leverages the trust users place in the npm ecosystem, making detection difficult for conventional antivirus solutions that rely on file signatures. Moreover, the packages were updated with benign code changes to avoid raising immediate suspicion, illustrating a trend toward more gradual, low‑profile infiltration.

Functional Overlaps with Known DPRK Malware

Comparative analysis reveals striking similarities between WeaselBiscuit and BeaverTail, another JavaScript stealer previously attributed to North Korean actors. Both share:

• Use of the chrome.storage API to exfiltrate data.
• Implementation of anti‑debugging techniques to hinder reverse engineering.
• Embedding of the payload within seemingly innocuous code blocks to evade detection.

These commonalities suggest a possible shared development environment or even direct code reuse, indicating that the threat actor may be refining existing tools rather than starting from scratch. The connection to the Contagious Interview campaign, which historically targets individuals and organizations through deceptive recruitment lures, further implies that the stolen extension data could be weaponized for espionage or credential‑stuffing attacks.

How the Stealer Operates

The execution flow of WeaselBiscuit can be broken down into several distinct phases:

1. Initial Injection – The malicious script is loaded as a standard ES6 module, making it harder for simple string‑matching scanners to flag.
2. Persistence Detection – The code checks for the presence of Chrome extension APIs, ensuring it runs only in the intended context.
3. Data Harvesting – Using asynchronous calls, the script queries chrome.storage.sync and chrome.storage.local, iterating over all stored key‑value pairs.
4. Obfuscation & Encoding – Collected data is base64‑encoded and split into small chunks to blend with normal network traffic.
5. Exfiltration – The encoded payloads are sent via HTTPS requests to attacker‑controlled domains, often using compromised legitimate services to avoid blacklisting.

Each step is designed to be lightweight and fast, ensuring that the malicious activity remains under the radar while maximizing data capture.

Implications for Developers and Users

For developers, the presence of WeaselBiscuit within popular npm packages signals a need to re‑evaluate dependency management practices. Relying solely on package popularity or star counts can be misleading; security vetting must become a core part of the development workflow. For end‑users, compromised extensions can lead to the leakage of highly sensitive information, including authentication tokens for cloud services, personalized settings, and even proprietary business data stored within the extension’s local storage.

The broader impact includes potential credential stuffing attacks, unauthorized access to corporate resources, and the erosion of trust in legitimate Chrome extensions. In a worst‑case scenario, attackers could leverage stolen data to launch further targeted campaigns, such as phishing messages that reference the compromised extension’s functionality.

Defensive Measures

Organizations and individuals can adopt a layered approach to protect against this class of threat:

• Regularly audit npm dependencies using tools like npm audit, yarn audit, or dedicated security scanners that can detect hidden payloads.
• Employ a lockfile (package-lock.json or yarn.lock) and enforce its use across development teams to prevent unintended package updates.
• Integrate automated security testing into CI/CD pipelines, leveraging static analysis and runtime monitoring to catch suspicious code patterns.
• Limit Chrome extension permissions to the minimum required, and regularly review granted permissions through the Chrome Web Store dashboard.
• Enable browser‑level protections such as Google’s Safe Browsing and consider using security extensions that can warn about known malicious packages.
• Maintain an up‑to‑date threat intelligence feed that includes information on emerging malware families like WeaselBiscuit, allowing proactive blocking.

Conclusion

The discovery of WeaselBiscuit across a dozen npm packages serves as a stark reminder that even trusted repositories can become vectors for sophisticated malware. By understanding the stealer’s operational phases, recognizing its ties to known threat actors, and implementing robust defensive measures, developers and users can significantly reduce their exposure. For those seeking to enhance their security posture, Grivyonx Cloud offers AI‑driven automation and cyber‑intelligence services designed to detect and mitigate such supply‑chain threats, ensuring a safer development and browsing experience.