MalwareTips News 13 npm packages caught stealing Chrome extension data

[News Now]

Image: The Hacker News

Developers who installed any of 13 identified npm packages may have exposed sensitive data stored by Chrome extensions. The packages delivered a newly documented JavaScript data thief called WeaselBiscuit on Windows, macOS and Linux.

Check projects for the affected packages​

The Hacker News reported the findings from OpenSourceMalware, whose researchers identified WeaselBiscuit and links in its code to previously known malware. Anyone who used one of the packages should remove it, review the affected computer and rotate credentials or wallet access that may have been exposed through Chrome extensions.

• Scoped packages: @biz44/id10-client, @biz44/id12-client, @biz44/id44-client, @biz44/id79-client, @biz44/id95-client, @biz44/id99-client, @biz44/process-runtime-utils and @biz44/runtime-utils.
• Other packages: engin1, id79-client, process-lhpm, process-mite and process-tailwind.
• Search package.json and lockfiles such as package-lock.json across local projects, build systems and deployed applications for these exact names.

Important

Changing a browser password alone may not address everything at risk. The malware copied readable files from Chrome's extension storage, which can include sensitive wallet-extension state or other extension-held information.

What the malware can collect​

Importing an affected npm package triggers loader.js, which downloads the main malware from the Npoint online storage service and runs it directly in memory. It then obtains its command-and-control settings, profiles the computer and harvests Chrome extension storage.

On Windows, the operator can also instruct WeaselBiscuit to record clipboard contents and keystrokes. The reported command-and-control indicator is 103.170.217[.]184:8787, which defenders can check in network and security logs.

Smaller scope, but financially relevant​

WeaselBiscuit does not include remote access, persistence, cryptocurrency wallet-draining code or the ability to install secondary malware. That narrower feature set does not make stolen extension data harmless: researchers said it could reveal wallet-extension state and other sensitive information.

OpenSourceMalware found meaningful code and infrastructure similarities to malware associated with North Korea's Contagious Interview operation. However, the researchers said available evidence is not enough to attribute WeaselBiscuit conclusively to North Korean operators.