[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fV-nibHkYwyXMZQtkVNQAfHDDYt5MIpBbTcHtp2jwJIQ":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":42,"controls":49},"3503f876-502d-48fd-93e0-478d51ca39fd","malicious-npm-packages-distribute-weaselbiscuit-stealer-targeting-chrome-extension-data","dbf6b6bd-c032-4d77-8d2b-3a62c8a1da79","Malicious npm Packages Distribute WeaselBiscuit Stealer Targeting Chrome Extension Data","Threat actors embedded the WeaselBiscuit stealer across 13 npm packages, exploiting the trust developers place in open-source ecosystems to deliver malware with functional ties to North Korean campaigns. Once installed, the stealer silently harvests Chrome extension storage—which often contains authentication tokens, seed phrases, and credentials—while also logging keystrokes and clipboard data. This attack illustrates how supply chain poisoning can bypass traditional perimeter defenses by targeting the developer workstation directly. The use of a stripped-down, less-detected variant of known malware families suggests deliberate evasion of signature-based detection tools.","**Immediate actions:**\n- Audit all recently installed npm packages against known malicious package lists and remove or quarantine any of the 13 identified WeaselBiscuit packages immediately.\n- Rotate all credentials, tokens, and sensitive data stored in Chrome extensions on any developer systems that may have been compromised.\n- Run endpoint detection scans on developer machines to identify keylogger or clipboard-monitoring artifacts.\n\n**Long-term improvements:**\n- Enforce a package allowlist policy and require cryptographic integrity verification (e.g., lockfiles and provenance attestation) before any npm package is approved for use.\n- Integrate software composition analysis (SCA) tools into CI\u002FCD pipelines to automatically flag suspicious or newly published packages with low download history.\n- Train developers to evaluate npm package provenance, maintainer reputation, and publish dates before adding dependencies to projects.\n\n**Detection measures:**\n- Deploy endpoint detection and response (EDR) solutions on all developer workstations capable of identifying browser storage access and clipboard-hooking behavior.\n- Monitor network egress traffic from developer environments for unexpected outbound connections to unknown external endpoints indicative of data exfiltration.",[12,13,14,15,16,17,18,19,20],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SR-11: Component Authenticity","SLSA Framework Level 2+: Provenance and Build Integrity","GDPR Article 32: Security of Processing (if EU user data is affected)","OpenSSF Scorecard: Dependency Verification Best Practices",{},"published","2026-09-18T12:21:02.567186+00:00","2026-09-18T12:21:02.242+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fweaselbiscuit-stealer-spreads-via-13.html","weaselbiscuit-stealer-spreads-via-13-npm-packages-to-harvest-chrome-extension-st-987fdb","WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage",[30,36],{"id":31,"name":32,"slug":33,"description":34,"color":35},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":37,"name":38,"slug":39,"description":40,"color":41},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[43],{"id":44,"date":45,"edition":46,"title":47,"audio_url":48},"af5388cc-d8d5-4255-b753-58776e161996","2026-09-18","afternoon","ThreatNoir Afternoon Brief — September 18","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-18\u002Fthreatnoir-afternoon-brief-2026-09-18.mp3",[50,54,58],{"slug":51,"name":52,"problem":53},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":55,"name":56,"problem":57},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":59,"name":60,"problem":61},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]