WeaselBiscuit Stealer Targets Chrome Extension Storage via Malicious npm Packages
A new JavaScript stealer, WeaselBiscuit, has been distributed through 13 npm packages, aiming to steal sensitive data from Chrome extension storage.
Security researchers have uncovered a campaign distributing a new information-stealing malware, dubbed WeaselBiscuit, through a network of 13 malicious npm packages. This sophisticated JavaScript-based threat is designed to target and exfiltrate sensitive data stored within Chrome browser extensions, posing a significant risk to users whose browsing activity and credentials might be compromised.
The discovery highlights a growing trend of attackers leveraging popular software development ecosystems like npm to distribute malware. By disguising their malicious code within seemingly legitimate packages, threat actors can reach a wide audience of developers, who may inadvertently incorporate the compromised libraries into their own projects. Once integrated, WeaselBiscuit can then execute its payload, focusing on the storage mechanisms used by Chrome extensions to safeguard user data.
Researchers at OpenSourceMalware, who identified the campaign, noted functional similarities between WeaselBiscuit and other malware strains. Specifically, they observed overlaps with malware families previously linked to the Democratic People's Republic of Korea's (DPRK) 'Contagious Interview' campaign, including the BeaverTail malware. This potential attribution suggests a connection to state-sponsored or state-aligned threat actors, known for their persistent and sophisticated cyber operations.
The primary objective of WeaselBiscuit appears to be the harvesting of valuable information that users store within their browser extensions. This could include session tokens, authentication cookies, stored credentials, and potentially sensitive personal or financial data that extensions might cache or manage. The exfiltration of such data can lead to account takeovers, identity theft, and further compromise of user systems and networks.
While the exact scale of the compromise is still under investigation, the distribution across 13 npm packages indicates a deliberate and potentially widespread effort to infect unsuspecting developers and their end-users. The use of npm, a critical dependency manager for JavaScript development, means that any project relying on these compromised packages could become a vector for the stealer.
This incident underscores the persistent threat posed by supply chain attacks within the software development lifecycle. Developers are urged to exercise extreme caution when incorporating third-party libraries, ensuring they are sourced from trusted repositories and regularly scanned for malicious content. The ongoing evolution of malware, such as WeaselBiscuit, demonstrates the need for continuous vigilance and robust security practices throughout the development and deployment pipeline.
Further analysis is expected to reveal more details about the specific data WeaselBiscuit targets and the full extent of its operational infrastructure. The connection to known DPRK-linked campaigns also warrants close monitoring by national cybersecurity agencies and threat intelligence firms.