suspectedhighSupply chainFirst reported Sep 18, 2026 · Updated Oct 17, 2026
npm: 13 malicious packages found delivering WeaselBiscuit stealer
Researchers discovered 13 npm packages distributing a previously undocumented JavaScript stealer called WeaselBiscuit that harvests Chrome extension storage. The malware reportedly shares functionality with BeaverTail and other strains linked to North Korea's Contagious Interview campaign.
Members only
The full record: the timeline (3 updates) and 4 linked reports
- Every update as it happened, with the status at each step
- Every report behind the record, newest first
- Alerts the moment npm — or anything else you track — is hit again
A free account is all it takes — no card, one minute.