Affected Systems

13 npm packages (@biz44/id10-client, @biz44/id12-client, @biz44/id44-client, @biz44/id79-client, @biz44/id95-client, @biz44/id99-client, @biz44/process-runtime-utils, @biz44/runtime-utils, engin1, id79-client, process-lhpm, process-mite, process-tailwind). Targets developers using npm on Windows, macOS, and Linux. Harvests Chrome extension storage, including wallet extensions and sensitive data. C2 server: 103.170.217[.]184:8787.

Exploitation Status

Active supply chain attack. Malicious packages were live on npm registry. WeaselBiscuit executes on import, fetching payload from Npoint dead drop. Likely linked to DPRK Contagious Interview campaign based on tradecraft overlap with BeaverTail and OtterCookie malware families.

Business Impact

Development teams using npm are at risk of credential and cryptocurrency wallet theft. WeaselBiscuit harvests Chrome extension storage (including wallet extensions), logs clipboard contents and keystrokes on Windows, and exfiltrates data to attacker C2. Targets software developers, IT professionals, and cryptocurrency users. No persistence mechanism, but immediate data theft occurs on package import. Financial impact possible through exposed wallet extension state and sensitive extension-held data.

Urgency

🔴 Immediate

Recommended Actions

  • Audit all npm dependencies for the 13 malicious packages listed and remove immediately if present: @biz44/id10-client, @biz44/id12-client, @biz44/id44-client, @biz44/id79-client, @biz44/id95-client, @biz44/id99-client, @biz44/process-runtime-utils, @biz44/runtime-utils, engin1, id79-client, process-lhpm, process-mite, process-tailwind
  • Block network connections to C2 infrastructure 103.170.217[.]184:8787 and monitor for connections to Npoint.io, api.ipify.org, and ip-api.com from developer workstations
  • Inspect Chrome extension Local Extension Settings directories on developer machines for unauthorized access or exfiltration, particularly for cryptocurrency wallet extensions
  • Rotate credentials and secrets for any developer who installed these packages, including cryptocurrency wallet keys and API tokens stored in Chrome extensions
  • Implement npm package verification workflows requiring manual review of new dependencies, especially from unfamiliar publishers like @biz44

---

# Threat Actor Context

Actor Profile

Contagious Interview (G1052) is a North Korean state-sponsored threat actor also tracked as DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, and DEV#POPPER. The group is attributed to the Democratic People's Republic of Korea (DPRK) and has been active since at least late 2022. Their primary motivation appears to be financial gain and intelligence collection, targeting software developers, IT professionals, and cryptocurrency users through social engineering campaigns. The actor is known for deploying multiple malware families including InvisibleFerret, BeaverTail, XORIndex Loader, HexEval Loader, OtterCookie, and now WeaselBiscuit. They leverage supply chain attacks via malicious npm packages and employ sophisticated developer-focused lures to compromise victims.

TTPs (Tactics, Techniques, Procedures)

Contagious Interview employs supply chain compromise (T1195.002 implied) by distributing 13 malicious npm packages under the @biz44 namespace and other names. The campaign leverages T1587.001 (Develop Capabilities: Malware) with WeaselBiscuit representing a streamlined stealer variant. Initial execution occurs via T1204.002 (User Execution: Malicious File) through npm imports triggering loader.js. The malware uses T1059.004 (Command and Scripting Interpreter: Unix Shell) for cross-platform execution. For C2, the actor employs T1071 (Application Layer Protocol) via Npoint.io dead drops for configuration and payload retrieval, and T1571 (Non-Standard Port) with C2 server 103.170.217[.]184:8787. Discovery techniques include T1083 (File and Directory Discovery) targeting Chrome extension storage directories and system profiling. Credential access is achieved through T1555.001 (Credentials from Password Stores: Keychain) by harvesting Chrome extension Local Extension Settings containing wallet data. Collection capabilities include T1115 (Clipboard Data) and T1056.001 (Input Capture: Keylogging) on Windows systems. Exfiltration occurs via T1567 (Exfiltration Over Web Service) uploading LevelDB key/value store files wholesale. The actor also uses T1583.001 (Acquire Infrastructure: Domains) and T1585 (Establish Accounts) for operational infrastructure.

Targets & Patterns

Contagious Interview primarily targets the software development community and open source ecosystem, specifically developers working with npm packages. The campaign focuses on software developers, IT professionals, and cryptocurrency users across Windows, macOS, and Linux platforms. The choice of npm as the distribution vector indicates targeting of JavaScript/Node.js developers who may have access to sensitive codebases, credentials, and cryptocurrency assets. The malware's focus on Chrome extension storage suggests specific interest in browser-based cryptocurrency wallets and extension-held authentication tokens. The cross-platform nature of WeaselBiscuit (supporting Windows, macOS, Linux) demonstrates intent to compromise the diverse operating system environments common in development shops. The financial motivation is evident through the targeting of crypto wallet extensions and the harvesting of extension state data that could enable account takeovers or financial theft. This targeting pattern aligns with North Korea's documented interest in cryptocurrency theft to fund state operations and evade sanctions.

Historical Context

WeaselBiscuit represents an evolution in Contagious Interview's malware development, exhibiting functional overlaps with previously documented DPRK malware families BeaverTail and OtterCookie. BeaverTail has been active since at least late 2022 as a cross-platform information stealer and downloader. OtterCookie, first documented by NTT Security Holdings in December 2024, combines information-stealing with remote access capabilities. WeaselBiscuit appears to be a streamlined, lightweight variant that borrows functions from both predecessors but removes heavier capabilities like remote access, persistence mechanisms, cryptocurrency wallet-draining code, and secondary payload delivery (e.g., InvisibleFerret). In October 2025, Cisco Talos identified npm package "node-nvm-ssh" that blurred distinctions between BeaverTail and OtterCookie, suggesting ongoing experimentation with hybrid malware. The current campaign continues established tradecraft including use of Npoint.io for dead drops (flagged by NVISO in November 2025), nested IP geolocation lookups via api.ipify.org and ip-api.com, and numerical campaign IDs mirroring the PolinRider pattern. This represents a tactical shift toward lighter, more targeted tooling optimized for npm supply chain compromise rather than full-featured RAT deployment.

Defensive Recommendations

  • Monitor npm package installations for suspicious @biz44 namespace packages and the 13 identified malicious packages (engin1, id79-client, process-lhpm, process-mite, process-tailwind, and @biz44/* variants); implement package integrity verification and private registry controls
  • Detect T1071 C2 communications to Npoint.io dead drops and suspicious connections to 103.170.217[.]184:8787; block or monitor api.ipify.org and ip-api.com geolocation lookups from server/build environments
  • Monitor T1083 file enumeration of Chrome extension directories (Local Extension Settings) across Windows (%LOCALAPPDATA%\Google\Chrome\User Data), macOS (~/Library/Application Support/Google/Chrome), and Linux (~/.config/google-chrome) using EDR or file integrity monitoring
  • Detect T1115 clipboard monitoring and T1056.001 keylogging on Windows systems via Sysmon Event IDs 1 (process creation) and 10 (process access) targeting user32.dll GetClipboardData and SetWindowsHookEx API calls
  • Implement T1587.001 supply chain defenses: require code signing for npm packages, use dependency scanning tools (npm audit, Snyk, Socket.dev) to detect malicious packages, and enforce least-privilege for build pipeline access to limit exfiltration via T1567

---

# Geopolitical Context

Geopolitical Context

The discovery of WeaselBiscuit represents a potential evolution in North Korea's Contagious Interview campaign, which has systematically targeted software developers and IT professionals since at least late 2022. This campaign aligns with the DPRK's documented strategy of leveraging cyber operations for revenue generation and intelligence collection to circumvent international sanctions. The deployment of 13 malicious npm packages demonstrates continued exploitation of open-source software ecosystems as attack vectors, reflecting Pyongyang's asymmetric approach to cyber operations that prioritizes low-cost, high-impact supply chain compromises. The malware's focus on Chrome extension storage—particularly wallet-extension data—is consistent with North Korea's broader pattern of financially motivated cyber activity, including cryptocurrency theft operations attributed to units such as the Lazarus Group and its sub-clusters. While researchers note meaningful code overlap with DPRK-associated BeaverTail and OtterCookie malware families, the absence of definitive infrastructure or operational indicators underscores the attribution challenges inherent in tracking state-sponsored cyber activity conducted through obfuscated channels.

State Actor Alignment

WeaselBiscuit exhibits functional overlaps with malware families linked to North Korea's Contagious Interview campaign, specifically BeaverTail (active since late 2022) and OtterCookie (documented December 2024). Tradecraft indicators consistent with DPRK operations include the use of Npoint.io for dead drop delivery (flagged by NVISO in November 2025), nested IP geolocation lookups via api.ipify.org and ip-api.com, C2 architecture similarities with OtterCookie, and numerical campaign ID tagging mirroring the PolinRider pattern. However, OpenSourceMalware emphasizes that no definitive attribution evidence exists in terms of operator infrastructure, victimology, campaign metadata, or code-signing material. The malware's stripped-down design—lacking persistence mechanisms, remote access capabilities, and secondary payload delivery—may indicate operational experimentation or compartmentalization within North Korean cyber units. This activity occurs within the context of longstanding international sanctions targeting the DPRK's weapons programs and its documented use of cyber operations for sanctions evasion and foreign currency generation.

Business Impacty pro region

The targeting of the global npm ecosystem—a critical component of JavaScript development infrastructure—poses supply chain risks to software development organizations across North America, Europe, and Asia-Pacific. The campaign's cross-platform capability (Windows, macOS, Linux) and focus on Chrome extension storage suggests potential impact on cryptocurrency users and fintech sectors worldwide, particularly in jurisdictions with significant digital asset activity such as South Korea, Japan, the United States, and European Union member states. For European organizations, this incident reinforces supply chain security concerns highlighted in the EU's NIS2 Directive and underscores the transnational nature of DPRK cyber threats that transcend traditional geographic boundaries. The use of open-source package repositories as distribution mechanisms complicates defensive measures, as these ecosystems are integral to global software development practices and lack centralized vetting mechanisms. The incident also highlights the persistent challenge faced by international sanctions regimes: North Korea's ability to conduct low-attribution cyber operations that generate revenue and intelligence while maintaining plausible deniability through infrastructure obfuscation and tooling evolution.

Forecast

If WeaselBiscuit is confirmed as part of North Korea's operational toolkit, it is likely that DPRK-affiliated actors will continue iterating on modular, lightweight malware variants designed to evade detection while maintaining core exfiltration capabilities. The stripped-down architecture may indicate testing of operational security improvements or adaptation to increased defensive scrutiny of npm and other open-source repositories. Organizations relying on JavaScript development ecosystems should anticipate continued supply chain targeting, particularly through typosquatting, dependency confusion, and compromised maintainer accounts. If international sanctions pressure on North Korea persists or intensifies, financially motivated cyber operations targeting cryptocurrency infrastructure are likely to remain a strategic priority for Pyongyang. The blurring of distinctions between BeaverTail and OtterCookie variants suggests potential consolidation or standardization of DPRK malware tooling, which could complicate attribution and tracking efforts. Defensive measures will likely require enhanced software composition analysis, runtime monitoring of package installation behaviors, and increased collaboration between open-source maintainers and threat intelligence providers to identify and remove malicious packages before widespread adoption.