Security researchers at OpenSourceMalware have identified 13 malicious npm packages delivering a previously undocumented JavaScript stealer called WeaselBiscuit. The packages share functional overlap with BeaverTail and OtterCookie — two malware families linked to North Korea’s Contagious Interview campaign — though researchers say there is no definitive attribution evidence for WeaselBiscuit itself. The threat is intentionally lean: no remote access module, no persistence mechanism, no secondary payload delivery. Instead it does one precise, financially dangerous thing: steal browser extension storage.
When triggered through an npm import, WeaselBiscuit pulls its main code from a Npoint dead drop and executes it in memory. It then contacts a command-and-control server at 103.170.217[.]184:8787 and begins harvesting raw LevelDB files from Chrome’s extension storage directory across Windows, macOS, and Linux. These files hold the internal state of browser extensions — including cryptocurrency wallet extensions like MetaMask, which store seed phrases and session data there. On Windows, the malware also logs clipboard contents and keystrokes on operator command.
The 13 packages were published under two namespaces: scoped packages @biz44/id12-client, @biz44/id44-client, @biz44/id79-client, @biz44/id95-client, @biz44/id99-client, @biz44/process-runtime-utils, and @biz44/runtime-utils; and bare-name packages engin1, id79-client, process-lhpm, process-mite, and process-tailwind. OpenSourceMalware has reported the packages to npm.
How to check if you’re affected
Affected products include any project that lists one of the 13 packages as a direct or transitive dependency. To check your environment:
- Run
npm ls @biz44/id12-client @biz44/id44-client @biz44/id79-client @biz44/id99-client @biz44/process-runtime-utils @biz44/runtime-utils engin1 id79-client process-lhpm process-mite process-tailwind 2>/dev/nullin your project root. - Also check for any
@biz44/scoped package withls node_modules/@biz44/ 2>/dev/null. - If a match is found, remove the package immediately, rotate any credentials accessible from that environment, and assume Chrome extension storage data may have been exfiltrated.