BreachFeed
← All confirmed incidents
companynpm
suspectedhighSupply chainFirst reported Sep 18, 2026

npm: 13 malicious packages found delivering WeaselBiscuit stealer

Researchers discovered 13 npm packages distributing a previously undocumented JavaScript stealer called WeaselBiscuit that harvests Chrome extension storage. The malware reportedly shares functionality with BeaverTail and other strains linked to North Korea's Contagious Interview campaign.

In the News

Coverage the BreachFeed team linked to this incident, newest first.

The Hacker News·Confirmed Breach
Share

Link — click to select, then copy:

https://breachfeed.com/article/cmu6ucbp91fajhou2nt3i4nm7

WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage

Cybersecurity researchers have discovered a cluster of 13 npm packages that have been found to deliver a previously undocumented JavaScript stealer codenamed WeaselBiscuit. The new malware family, per OpenSourceMalware, exhibits functional overlaps with two malware strains associated with the Democratic People's Republic of Korea's (DPRK) Contagious Interview campaign: BeaverTail and

npm: 13 malicious packages found delivering WeaselBiscuit stealer · BreachFeed