WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials

What it is

WeaselBiscuit is a lightweight Node.js infostealer found in 12+ npm packages (process-tailwind@1.1.99, engin1@1.3.99, swnwall@1.2.10, id79-client@1.1.79, and the @biz44 scope). The catalog summary covers the infection chain and capabilities; what it omits are the concrete hunting artifacts, the C2 route inventory, and the confidence-graded attribution basis.

How it works

The loader has no npm lifecycle hook — execution requires the package to be imported or manually started, so index.js calling initialize() is the trigger, not install. The stage runs in-memory via new Function on a Base64-decoded blob and never touches disk. The C2 (http://103.170.217.184:8787) is a plain Express service; the client polls two status routes every 5 seconds (/api/clipboard-status/<hostname>, /api/keyboard-mouse-status/<hostname>) and clipboard/keylogging are operator-gated by isMonitoring — dormant until switched on server-side. Public-IP geolocation uses a nested api.ipify.org → ip-api.com lookup (a DPRK-linked convention, not commodity). No screenshots, no wallet-drain, no browser-password decryptor, no InvisibleFerret/Python stage, no remote shell.

What to do

Search telemetry for these host artifacts and IOCs:

• On-disk: <package-directory>/.pid marker, %TEMP%\kb-monitor\keyboard-monitor-*.ps1, and detached Node / PowerShell child processes.
• C2: 103.170.217.184:8787 and the API route strings above.
• Stage identifiers 10, 12, 44, 79, 95, 99 (baked into both package names and uploads).
• Second-stage SHA-256: 7b15605f23b131b3eeea57e031ae7cb32fc4b78c7bbb2025aa7a561ea5ae5159
• Six Npoint first-stage resolvers plus the config resolver https://api.npoint.io/37c0a0c68bf7a94ed731:
• 24c25d5f5fcbb0992a4f (id 99), 641d37178a880b1e8b8f (id 10), 33e8d008c334b060adad (id 79), ddae72efbb6714fae922 (id 12), 933a731a5e97f4b45249 (id 95), 24c12c4b66a29747764f (unknown; 404 on retrieval).

Preserve tarball, publication metadata, maintainer account, and download history. Identify the importing parent app, since import (not install) is the execution path.

Caveats

The page grades its own confidence explicitly: malicious loader and infostealer function are High; "simplified/new branch" is Moderate (could be a commodity copy); DPRK attribution is Low-to-moderate — no operator infrastructure, victimology, signing material, or unique-code match recovered. "New family" is rated Low. id79-client's delivery link is unproven (its resolver returned 404). Treat the DPRK-strain label as a working hypothesis, not a conclusion.