A highly sophisticated malware attack has been unfolding on the npm package manager, exploiting 13 seemingly innocuous packages to spread a malicious code known as WeaselBiscuit Stealer. The attacker’s ultimate goal is to harvest sensitive data stored in Chrome browser extensions installed by unsuspecting users.
WeaselBiscuit Stealer is a form of malware that targets Chrome extension storage, specifically seeking out and stealing credentials, authentication tokens, and other sensitive information. This malicious code is distributed through a network of compromised npm packages, which are then installed on developers’ machines when they run their projects. The attacker’s choice of 13 targeted packages suggests a deliberate attempt to maximize the malware’s reach.
npm package managers play a crucial role in software development by providing pre-built libraries and tools that can be easily integrated into projects. However, this very convenience has been exploited by attackers, who have inserted malicious code into popular packages. When a developer installs one of these compromised packages on their machine, they inadvertently download the WeaselBiscuit Stealer malware as well.
Once installed, WeaselBiscuit Stealer begins scanning for Chrome browser extensions on the infected machine, searching specifically for those that store sensitive data such as login credentials or authentication tokens. This stolen information can be used by attackers to gain access to targeted systems and services, potentially even leading to identity exposure and active attack paths.
The fact that this malware has been spread through npm packages is particularly concerning due to the widespread adoption of these tools in software development. With thousands of developers worldwide using npm, the potential for WeaselBiscuit Stealer to infect multiple machines is significant. Furthermore, the malicious code’s ability to harvest sensitive data from Chrome extensions means that users who rely on browser-based applications may be at risk.
The impact of this attack highlights the importance of robust security measures in software development and usage. Developers should always verify the integrity of their project dependencies by checking package hashes against those provided by npm or other trusted sources. Additionally, users should exercise caution when installing extensions, ensuring they only download from reputable sources and keeping their Chrome browser up-to-date with the latest security patches.
Practically speaking, we recommend that developers take a few simple precautions to mitigate this risk: regularly review your project’s dependencies and run checks for any suspicious or malicious code; use package managers like npm with caution, always verifying the integrity of packages before installing them; and keep your browser extensions and software up-to-date.
Source: The Hacker News — 2026-09-18