Researchers found 13 npm packages delivering a new JavaScript stealer called WeaselBiscuit that targets Chrome extension storage. Here's what you need to know.
Imagine installing what looks like a harmless npm package, only to find out it's been silently copying everything stored in your Chrome extensions. That's exactly what researchers stumbled onto recently, and it's a lot more unsettling than it sounds.
A cluster of 13 npm packages has been caught delivering a brand-new JavaScript stealer. The malware's been nicknamed WeaselBiscuit, and according to researchers, it's specifically built to harvest data from Chrome extension storage. That's where a ton of sensitive stuff lives: session tokens, saved credentials, API keys, you name it.
### What Makes WeaselBiscuit Different
Here's the thing that caught everyone's attention. WeaselBiscuit isn't just some random piece of code floating around. It shares functional DNA with two known malware strains tied to the DPRK's Contagious Interview campaign, BeaverTail and InvisibleFerret. If you've been following supply chain attacks, those names should ring a bell.
> "Supply chain attacks through package managers are the new frontier. One compromised dependency can cascade into thousands of victims before anyone notices."
That overlap matters. It suggests this isn't amateur hour. Someone with resources and intent is iterating on a proven playbook, and npm is the delivery vehicle of choice.
### Why Chrome Extension Storage Is a Goldmine
If you're wondering why attackers would bother with extension storage specifically, think about it for a second. Chrome extensions often hold onto authentication tokens and user preferences that make life easier. But that convenience is exactly what makes them a target.
- Session cookies that bypass two-factor authentication
- OAuth tokens for services like Google, GitHub, and Slack
- Saved form data and API credentials
- Internal company tool access keys
Once that data is exfiltrated, an attacker can impersonate you across multiple services without ever needing your password.
### How This Fits Into the Bigger Picture
The Contagious Interview campaign has been running for a while now, mostly targeting developers through fake job interviews and malicious coding challenges. The shift toward npm packages as a distribution method makes sense. Developers trust package registries. We install dependencies without reading every line of code. That trust is the vulnerability.
For anyone working with antidetect browsers or managing multiple online identities, this is a wake-up call. The tools we rely on for privacy can become liabilities if the underlying supply chain is compromised.
### What You Should Actually Do
You don't need to panic, but you do need to pay attention. A few practical steps can go a long way:
- Audit your dependencies regularly. If a package hasn't been updated in years or has a sudden new maintainer, dig deeper.
- Use lockfiles and pin versions so a compromised update doesn't silently roll into your project.
- Monitor extension permissions. If a Chrome extension suddenly wants access to storage it never needed before, that's a red flag.
- Isolate sensitive work. If you're managing multiple accounts or doing anything privacy-sensitive, keep it separated from your general browsing environment.
### The Bottom Line
WeaselBiscuit is a reminder that the tools we trust can be turned against us. The npm ecosystem is powerful precisely because it's open and easy to contribute to, but that openness cuts both ways. Stay curious, stay cautious, and don't assume that a package is safe just because it's popular.
The researchers are still digging into the full scope of this campaign, so expect more details to surface. In the meantime, treat your dependencies like you'd treat any stranger handing you a USB drive. With polite suspicion.
