Cybersecurity researchers have uncovered a new cluster of 13 malicious npm packages designed to deliver a previously undocumented JavaScript information-stealing malware codenamed WeaselBiscuit. The discovery highlights the persistent threat of supply chain attacks targeting developers, IT professionals, and digital asset holders through popular open-source software repositories. According to findings published by OpenSourceMalware, the WeaselBiscuit malware family exhibits notable functional overlaps with two prominent malware strains linked to the Democratic People’s Republic of Korea’s (DPRK) notorious "Contagious Interview" campaign, namely BeaverTail and OtterCookie. Security researcher Paul McCarty, also known as 6mile, described the new strain as a smaller, lighter, and stripped-down alternative that has had many of the heavier and more complex functions removed entirely. Jenn Gile, co-founder of OpenSourceMalware, elaborated on the rationale behind the moniker in a statement shared with the cybersecurity community. She noted that it is a streamlined stealer borrowing several core functions from the DPRK-associated BeaverTail and OtterCookie tools, but implemented in a much smaller, self-contained package. This size and design philosophy directly inspired the name WeaselBiscuit, playing on the biological observation that a weasel is smaller than an otter, combined with the casual observation that biscuits are less elaborate than cookies. To understand the context of this new threat, it is helpful to examine its architectural lineage. BeaverTail has long been recognized as a cross-platform information-stealing malware and downloader deployed by North Korean threat actors operating behind the Contagious Interview campaign. These actors have historically targeted software developers, IT professionals, and cryptocurrency users, utilizing the malware to compromise systems since at least late 2022. OtterCookie, meanwhile, combines traditional information-stealing capabilities with robust remote access functionality. This dual-purpose design allows operators to execute arbitrary commands directly on compromised host machines. OtterCookie was first publicly documented by NTT Security Holdings in December 2024, representing an evolution in the technical sophistication of supply chain intrusions. In contrast, WeaselBiscuit stands out for its extreme simplicity. Unlike its larger counterparts, the new malware lacks remote access capabilities, system persistence mechanisms, cryptocurrency wallet-draining code, and the functionality required to deliver secondary payloads such as the InvisibleFerret backdoor. Instead, WeaselBiscuit relies on a streamlined execution model. The infection is triggered via a standard npm import statement, which causes a bundled loader script known as loader.js to quietly pull the main malware payload from an Npoint dead-drop service and execute it directly in the system’s memory. Upon successful execution, the malware resolves its command-and-control configuration from a separate Npoint URL. It then profiles the compromised host and proceeds to harvest Chrome extension storage across major operating systems, including Windows, macOS, and Linux. Depending on the specific operator commands received from its command-and-control server, which has been tracked to the IP address 103.170.217.184 on port 8787, the malware can also log clipboard contents and capture keystrokes on Windows machines. Even though WeaselBiscuit lacks the dedicated cryptocurrency wallet-draining functions found in larger strains, security experts warn that its ability to target Chrome extension storage remains a significant financial hazard. McCarty explained that this capability can expose wallet extension states and other sensitive data stored within browser extensions. The malware accomplishes this by wholesale uploading every readable, non-empty file located under the extension’s Local Extension Settings directory, which functions as a raw LevelDB key-value store. Despite the meaningful overlap in code and tradecraft with tools traditionally associated with North Korean state-sponsored operations, researchers at OpenSourceMalware have emphasized that definitive proof remains elusive. They noted that there is currently no conclusive evidence regarding operator infrastructure, specific victimology, campaign metadata, or digital signing material that would allow for a definitive attribution to North Korea. Nevertheless, researchers continue to monitor tradecraft signals that frequently point toward DPRK-linked actors in similar software supply chain campaigns. If WeaselBiscuit is ultimately confirmed to be a new addition to the DPRK’s malware arsenal, it would not be the first time these threat actors have experimented with merging the features of BeaverTail and OtterCookie. In October 2025, Cisco Talos reported the identification of an npm package named node-nvm-ssh, which similarly displayed characteristics of both BeaverTail and OtterCookie, effectively blurring the lines between the two distinct malware families. Post navigation Russian Enterprises Target of Three Distinct Threat Clusters Deploying Custom Backdoors and Ransomware