Security researchers have uncovered a cluster of 13 npm packages that deliver a previously undocumented JavaScript stealer named WeaselBiscuit. The discovery was made by OpenSourceMalware, which identified the malicious packages as part of a supply-chain campaign aimed at developers who install npm dependencies.
WeaselBiscuit is designed to harvest data from Chrome extension storage, a feature that lets extensions persist data such as authentication tokens, settings, and other sensitive information. By targeting this storage, the stealer can potentially access credentials and session data that users have entrusted to their browser extensions.
The malware family exhibits functional overlaps with two other known malware strains, according to the researchers. While the exact relationship is not detailed in the source, the overlap suggests that WeaselBiscuit may reuse code or techniques from earlier threats, making it a notable addition to the evolving ecosystem of JavaScript-based supply-chain attacks.