WeaselBiscuit is a newly identified JavaScript infostealer malware distributed through 11 malicious npm packages. It operates by importing malicious code via npm, launching a detached Node.js process to execute payloads retrieved from various Npoint URLs. The malware communicates with a C2 server hosted at IP 103.170.217.184 on port 8787. It performs host profiling, steals Chrome extension storage containing wallet signing states, captures clipboard data, and logs keystrokes on Windows systems when instructed. This malware is a stripped-down variant of DPRK-linked BeaverTail and OtterCookie families, lacking advanced capabilities such as wallet draining, password decryption, Python-based second stages, screenshot capture, and remote shell access. Numeric campaign identifiers embedded in package names facilitate tracking of infection campaigns. Technical overlaps, including use of Npoint dead-drop patterns and IP geolocation techniques, suggest possible DPRK attribution, though definitive confirmation is pending further investigation.

The malware compromises infected systems by stealing sensitive information including Chrome extension data related to wallet signing, clipboard contents, and keystrokes on Windows. This can lead to exposure of cryptocurrency wallet states and potentially other sensitive user data. However, it does not currently perform wallet draining, password decryption, or remote control functions, limiting its direct destructive impact compared to related malware families.

No official patch or remediation is indicated as this is malware distributed via malicious npm packages. Mitigation should focus on preventing installation of untrusted npm packages, monitoring for suspicious Node.js processes, and blocking communication to the identified C2 IP (103.170.217.184) and associated Npoint URLs. Organizations should audit npm dependencies and employ supply chain security best practices to reduce risk.