other

WeaselBiscuit

JavaScript information stealer distributed through npm packages, loaded from a remote JSON dead drop and executed in memory, with Chrome extension storage as its main collection target.

Current clusters

security1 publisher

Thirteen npm packages ship a stripped-down stealer that uploads Chrome's extension storage wholesale

OpenSourceMalware says WeaselBiscuit borrows functions from DPRK's BeaverTail and OtterCookie but strips out the persistence and the wallet drainer. It runs from memory on an npm import and takes Chrome's extension storage.

Publishers:thehackernews.com

Reality

Evidence58
Adoption: Insufficient
Hype gap+12
Incentives62
Confidence55