Poisoned Pipeline / Incidents / AS32
WeaselBiscuit npm import-time stealer
OpenSourceMalware documented WeaselBiscuit, a stripped-down JS stealer
overlapping DPRK Contagious Interview tooling (BeaverTail/OtterCookie).
Thirteen npm packages delivered it. A detached Node child loads a payload
from an Npoint dead drop and runs it in memory. It profiles the host and
uploads Chrome extension LevelDB wholesale. No disk persistence, no RAT.
Several packages were still live on npm at publication.
Mapped techniques
- T0109 Publish malicious artifact
- T0159 Malicious artifact execution
- T0184 Harvesting sensitive information from files
- T0108 Accounts in public registry
supply-chain npm WeaselBiscuit cluster
Thirteen npm packages, including @biz44/* and process-* names.
Import-triggered; payload executed in memory from a remote drop.
Wholesale upload of Chrome Local Extension Settings (LevelDB).
Cluster of related publisher accounts on npm.