Threat Intelligence

New 'WeaselBiscuit' Malware Found Hidden in 13 npm Packages Targeting Developers

The Hacker News · 18 Sept 2026

Key Takeaway Businesses that rely on developers using npm packages should implement dependency scanning tools and review third-party code before it's used in production environments.

Security researchers have identified a new malware family called WeaselBiscuit, hidden inside 13 npm packages available on the popular JavaScript package registry. The malware shares code similarities with two known North Korean-linked threats, BeaverTail and OtterCookie, which have previously been used in campaigns targeting software developers and cryptocurrency users. WeaselBiscuit is described as a smaller, stripped-down version of these tools, lacking some of their more advanced features such as remote access and cryptocurrency wallet theft.

Once a developer installs one of the infected npm packages, a loader script quietly fetches the main malware payload from an external web address and runs it directly in a computer's memory, avoiding leaving obvious files behind. WeaselBiscuit then profiles the infected machine and steals data stored by Chrome browser extensions on Windows, macOS, and Linux systems. On Windows machines specifically, it can also be instructed to record clipboard content and keystrokes, giving attackers access to sensitive information typed or copied by the user.

Because npm packages are widely used by software developers to speed up coding, malicious packages like these can spread quickly through development pipelines before being detected. This incident highlights the ongoing risk of supply chain attacks hidden within open-source software repositories.

npm supply chain attack malware information stealer open source security

Summarised by CISO AI from The Hacker News. We link back to every original so you can read it yourself.