A cluster of 13 npm packages has been identified delivering a previously undocumented JavaScript stealer, codenamed **WeaselBiscuit**. According to **OpenSourceMalware**, this new malware family shares functional overlaps with **BeaverTail** and **OtterCookie**, malware strains associated with the Democratic People's Republic of Korea's (**DPRK**) **Contagious Interview** campaign. "It's smaller, lighter, and stripped down, with many of the heavier functions removed entirely," explained security researcher Paul McCarty (aka 6mile). ### The Malicious Packages The identified packages distributing **WeaselBiscuit** include: * @biz44/id10-client * @biz44/id12-client * @biz44/id44-client * @biz44/id79-client * @biz44/id95-client * @biz44/id99-client * @biz44/process-runtime-utils * @biz44/runtime-utils * engin1 * id79-client * process-lhpm * process-mite * process-tailwind Jenn Gile, co-founder of **OpenSourceMalware**, elaborated on the malware's nature: "It's a stripped-down stealer that borrows several functions from DPRK's **BeaverTail** and **OtterCookie**, but is much smaller and self-contained. Hence the 'WeaselBiscuit' name, because a weasel is smaller than an otter, and we can argue that biscuits are less fancy than cookies." ### Connections to DPRK's Arsenal **BeaverTail** is a cross-platform information-stealing malware and downloader, active since late 2022, operated by North Korean threat actors targeting software developers, IT professionals, and cryptocurrency users. **OtterCookie**, first documented by **NTT Security Holdings** in December 2024, combines information-stealing with remote access capabilities, allowing operators to execute commands on compromised hosts. ### WeaselBiscuit's Modus Operandi **WeaselBiscuit** stands out for its simplicity. It lacks remote access, persistence mechanisms, cryptocurrency wallet-draining code, and the ability to deliver secondary payloads like **InvisibleFerret**. Instead, it's activated via an npm import, which triggers a loader (**loader.js**) to fetch the main malware from an **Npoint** dead drop and execute it directly in memory.  Upon execution, **WeaselBiscuit** resolves its command-and-control (C2) configuration from a separate **Npoint** URL, profiles the compromised host, and harvests **Chrome** extension storage across Windows, macOS, and Linux. Depending on commands from the C2 server (103.170.217\[.\]184:8787), it can also log clipboard contents and keystrokes on Windows machines. McCarty highlighted the financial relevance: "While this malware does not have the same crypto wallet stealer functions as its big siblings, the Chrome extension-storage capability is financially relevant: it can expose wallet-extension state or other extension-held sensitive data. It uploads every readable, nonempty file under the extension's Local Extension Settings directory — a raw LevelDB key/value store — wholesale." ### Attribution Challenges and Tradecraft Signals While **OpenSourceMalware** notes a "meaningful overlap with DPRK-associated **Contagious Interview** tooling," definitive evidence for attribution to North Korea, such as operator infrastructure, victimology, campaign metadata, or signing material, is currently lacking. However, several tradecraft signals point towards North Korean involvement: * The use of **Npoint.io**, a lightweight online JSON storage service, previously flagged by **NVISO** in connection with **Contagious Interview**. * The use of nested public-IP and geolocation lookups via **api.ipify.org** and **ip-api.com**. * Similarities in C2 architecture that overlap with **OtterCookie**. * The use of numerical campaign IDs (10, 12, 44, 79, 95, 99) to tag each install, mirroring that of **PolinRider**. If **WeaselBiscuit** is confirmed as the latest addition to the **DPRK**'s malware arsenal, it wouldn't be the first time these threat actors have merged features from **BeaverTail** and **OtterCookie**. In October 2025, **Cisco Talos** reported identifying an npm package named "node-nvm-ssh" that exhibited characteristics of both, blurring the distinction between the two malware families.