opensourcemalware.comPublished
WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials
Excerpt
The OpenSourceMalware team spends a lot of time looking at malicious npm packages, and after a while you start seeing the same patterns over and over. So when something new and genuinely different shows up, it’ stopping for. That happened this week when we found 11 npm packages secretly hiding a brand new JavaScript stealer. It looks and feels like the DPRK’s BeaverT
lighter, and stripped down, with many of the heavier functions removed entirely.
We're calling it WeaselBiscuit. It isn’t an established family name. I made it up, and I think it’ Our automation flagged these packages as…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by opensourcemalware.com on opensourcemalware.com.
Mentioned in the excerpt
More from opensourcemalware.com4
- GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font Fileopensourcemalware.com · Published 16 Oct
- ChainVeil and ViteVenom are DPRK’s PolinRider Campaignopensourcemalware.com · Published 17 Jul
- PolinRider Confirmed Footprint Grows 6.5x Since Marchopensourcemalware.com · Published 15 Jul
- Lazarus Group Uses Git Hooks To Hide Malwareopensourcemalware.com · Published 6 May
On the same topics
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installershexastrike.com · Published 25 Mar
- Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent TrafficThe Hacker News · Published 19 Oct
- Investigating Ephemeral Supply Chain TamperingMandiant (Google) · Published 15 Oct
