WeaselBiscuit Infostealer Found in Malicious npm Packages

Sep 17, 2026 · Original article ↗

Summary

Researchers analyzed WeaselBiscuit, a staged Node.js infostealer found in malicious npm packages. It steals Chrome extension data and can collect clipboard contents and Windows keystrokes; links to DPRK actors remain unconfirmed.

Key points

The malware arrives through npm packages that launch a detached Node.js loader, which retrieves and executes a Base64-encoded second stage from api[.]npoint[.]io.
The recovered stage communicates with a shared HTTP C2 at 103.170.217.184:8787 and profiles infected hosts.
It uploads readable files from Chrome profiles’ Local Extension Settings directories on Windows, macOS, and Linux, potentially exposing wallet-extension data.
Clipboard collection and Windows keylogging are operator-gated; the malware lacks direct wallet-draining, browser-password decryption, and seed-phrase scanning capabilities.
The researchers found shared loaders and indicators across a cluster of npm packages, with numeric identifiers included in uploads.
Behavioral similarities to BeaverTail and OtterCookie support a possible lineage, but the article describes DPRK attribution as a low-to-moderate-confidence hypothesis, not a confirmed conclusion.
The article recommends preserving package evidence and searching telemetry for the listed resolver URLs, C2 address, identifiers, and API routes.

Article Details

Attack Vectors: Malicious npm packages execute a detached Node.js loader when imported by an application.
The loader retrieves Base64-encoded JavaScript from Npoint URLs, decodes it, and executes it in memory using new Function.
The malware profiles infected hosts and collects Chrome extension storage; it can also collect clipboard contents and Windows keystrokes when enabled by the operator.
Collected information is sent to the malware's HTTP C2.
Defensive Notes: Preserve npm package tarballs, publication metadata, maintainer-account information, dependency graphs, download history, and source-repository references.
Search telemetry for the listed Npoint resolver URLs, C2 address, stage identifiers, and API route strings.
Review affected endpoints for .pid files, detached Node processes, PowerShell processes, and %TEMP%\kb-monitor\keyboard-monitor-*.ps1.
Identify applications importing the packages; the article says the packages have no npm lifecycle hook, so execution requires an import or manual start.
Treat the DPRK attribution and proposed BeaverTail/OtterCookie lineage as investigative hypotheses, not confirmed conclusions.

Indicators of compromise

Type	Indicator	Context
SHA256	`7b15605f23b131b3eeea57e031ae7cb32fc4b78c7bbb2025aa7a561ea5ae5159`	SHA-256 hash of the recovered WeaselBiscuit second-stage artifact.
URL	`hxxp[:]//103[.]170[.]217[.]184:8787`	HTTP C2 endpoint used by the malware for polling and data exfiltration.
URL	`hxxps[:]//api[.]npoint[.]io/24c12c4b66a29747764f`	Resolver hard-coded by id79-client; retrieval returned HTTP 404.
URL	`hxxps[:]//api[.]npoint[.]io/24c25d5f5fcbb0992a4f`	Npoint resolver used to retrieve the confirmed process-tailwind payload.
URL	`hxxps[:]//api[.]npoint[.]io/33e8d008c334b060adad`	Npoint resolver identified as a confirmed WeaselBiscuit-clone payload source.
URL	`hxxps[:]//api[.]npoint[.]io/37c0a0c68bf7a94ed731`	Npoint configuration resolver used by recovered stages to obtain the C2 address.
URL	`hxxps[:]//api[.]npoint[.]io/641d37178a880b1e8b8f`	Npoint resolver identified as a confirmed payload source for a related malicious package.
URL	`hxxps[:]//api[.]npoint[.]io/933a731a5e97f4b45249`	Npoint resolver identified as a confirmed WeaselBiscuit-clone payload source.
URL	`hxxps[:]//api[.]npoint[.]io/ddae72efbb6714fae922`	Npoint resolver identified as a confirmed WeaselBiscuit-clone payload source.