Your browser extensions are a credential store

Most infostealers go for the obvious: saved passwords, browser cookies, cryptocurrency wallet files. This one skips all of that.

What it takes instead is the contents of Chrome's extension storage — every readable, non-empty file under the Local Extension Settings directory, uploaded wholesale. That is a raw LevelDB key-value store, and it is where every browser extension you have installed keeps its state.

The packages

OpenSourceMalware documented a cluster of thirteen npm packages delivering a previously undocumented JavaScript stealer they named WeaselBiscuit. Check your lockfiles for:

@biz44/id10-client engin1 @biz44/id12-client id79-client @biz44/id44-client process-lhpm @biz44/id79-client process-mite @biz44/id95-client process-tailwind @biz44/id99-client @biz44/process-runtime-utils @biz44/runtime-utils

Note the naming. process-tailwind, process-mite, process-lhpm, runtime-utils — these read like internal utility packages a colleague might have published, not like typosquats of famous libraries. The researchers' cluster analysis links nineteen nodes through shared file hashes, shared dead-drop URLs and a common command server, with process-tailwind at the centre.

How it runs

1 The package is imported 2 loader.js fetches the main payload from an Npoint dead drop 3 The payload is evaluated directly in memory — nothing is written to disk 4 A second Npoint URL supplies the command-and-control configuration 5 The host is profiled and extension storage is harvested, on Windows, macOS and Linux 6 The implant polls 103.170.217[.]184:8787 for commands, which on Windows can include clipboard logging and keystroke capture

The trigger is an ordinary import. No installation script, no post-install hook, no file to scan.

What it deliberately does not do

No remote access. No persistence. No wallet-draining code. No ability to fetch a secondary payload.

Its predecessors in this family have all of those. WeaselBiscuit had them removed, and that is the design decision worth noticing. Every capability is a detection surface and a piece of code to maintain. This one does one job, in memory, and leaves.

The researchers' own framing captures it: a weasel is smaller than an otter, and biscuits are less fancy than cookies. The naming is a joke; the trend it describes is not.

Why extension storage is the smart target

Ask most people to list where credentials live on their machine and you will get the password manager, the browser's saved logins, maybe .ssh and .aws. Nobody says "the extension storage directory".

But that is where extensions keep everything they hold:

• Cryptocurrency wallet extensions keep signing state there
• Password manager extensions keep vault metadata and session state
• Developer extensions keep API tokens for the services they connect to
• Authenticator extensions keep seeds
• Anything with a login keeps its session

A stealer that takes extension storage does not need to break a wallet's encryption or a password manager's vault. It takes whatever the extension itself decided to leave on disk, and lets the operator sort through it later.

The researchers were direct about the economics: it lacks the crypto wallet functions of its larger siblings, but extension storage is financially relevant on its own, because it can expose wallet-extension state or other extension-held sensitive data.

For an organisation, the practical consequence is that your browser extension inventory is now part of your credential inventory. Most companies have neither.

On attribution, the researchers were careful and so are we

The obvious story here is North Korea. WeaselBiscuit borrows functions from BeaverTail and OtterCookie, both tied to the DPRK's Contagious Interview campaign against developers and cryptocurrency users. The supporting signals are there: use of Npoint.io as a dead drop, which NVISO flagged in connection with that campaign in November 2025; nested public-IP and geolocation lookups through api.ipify.org and ip-api.com; C2 architecture overlapping with OtterCookie; and numerical campaign IDs tagging each install, matching a known pattern.

OpenSourceMalware states plainly that despite the meaningful overlap, there is no definitive evidence — in operator infrastructure, victimology, campaign metadata or signing material — to conclusively attribute this to North Korea.

We are repeating that because a headline saying "North Korean malware" would travel further and would be a claim the people who did the work declined to make. Functional similarity is not attribution. If it turns out to be correct, it will be because someone produced evidence, not because the code rhymed.

The dead drop, again

The payload is fetched from Npoint.io, a lightweight JSON hosting service. Geolocation comes from api.ipify.org and ip-api.com.

This is the fifth time this month we have covered malware that routes its most sensitive traffic through a service nobody blocks. An implant shaping its command traffic as NTP. A phishing platform on residential proxies. A scanning campaign from Google Cloud ranges. A backdoor using the GitHub REST API. Now a JSON storage service and two IP lookup APIs.

The pattern is stable enough to plan around: attackers do not hide traffic, they place it where inspection does not reach. Which means detection has to move from destination to behaviour — who is connecting, how often, and whether that machine has any business doing it.

What to do

1. Search your lockfiles and registries for the thirteen package names. package-lock.json, yarn.lock, pnpm-lock.yaml, and any internal proxy or mirror. Do this across every repository, not just the active ones.
2. If you find one, treat it as a credential incident. In-memory execution means there may be nothing on disk to find. Rotate what that machine could reach, and inventory the browser extensions installed on it.
3. Start an extension inventory on developer machines. Which extensions, which users, which ones hold tokens or wallet state. This is the item most organisations do not have and will take the longest to build.
4. Monitor egress to npoint.io from build agents and developer workstations. It is a legitimate service with very few legitimate uses in a build pipeline.
5. Revisit how packages enter your projects. A name like process-tailwind passes a casual review precisely because it does not look like a typosquat. Allowlisting scopes, or requiring review for new direct dependencies, is the control that catches this class.

This is the third article this month where developer workstations were the target rather than servers — after the exposed Vite development servers leaking cloud credentials and the Docker Sandboxes escape. The pattern is worth stating once more: development environments hold production keys, and they are governed like development environments.

4Tify reviews developer workstation and supply chain exposure, including the dependency and extension inventories nobody maintains. If you want yours assessed, get in touch.