OpenSourceMalware (17 September 2026) documents WeaselBiscuit, a lean new JavaScript infostealer hidden in a cluster of npm packages (including @biz44/* client packages, engin1 and process-* packages). It lands via an npm import and starts a detached background Node process, pulls its real payload from an Npoint URL and runs it in memory, beacons to a shared HTTP C2 at 103.170.217.184:8787, profiles the host, and steals Chrome extension storage on Windows, macOS and Linux, where wallet extensions keep their signing state; on operator command it also captures clipboard contents and logs Windows keystrokes.

Unlike BeaverTail/OtterCookie it has no wallet-draining code, no InvisibleFerret Python second stage and no remote shell. OpenSourceMalware tentatively attributes it to DPRK because of meaningful overlap with Contagious Interview tooling, but stresses this is an analytic hypothesis, not a confirmed attribution — keep distinct from the ACSC WaterPlum joint advisory already on Cyberstack. Developers: audit unexpected npm dependencies and rotate secrets held in browser extensions on affected hosts. (source: OpenSourceMalware)

Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: OpenSourceMalware)