WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage

As cited

Copy frozen at 2026-09-18 13:01 UTC (site build).

threat intel

WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage

Researchers identified 13 malicious npm packages distributing a JavaScript stealer named WeaselBiscuit that targets Chrome extension storage. The malware shares functional similarities with BeaverTail and other tools linked to the DPRK's Contagious Interview campaign.

Why it matters: Developers who installed these npm packages may have credentials and sensitive data harvested from browser extensions; practitioners should audit dependencies and scan for WeaselBiscuit indicators of compromise (IOCs) in their environments.

Source published

2026-09-18 10:40 UTC

First seen by Cybersecurity Tracker

2026-09-18 11:23 UTC