🕵️ BeaverTail

The items that name it 12

• Earliest Known PolinRider Malware Found in 2025 npm Packages
  writeupas threat actors2026-10-30It is written here as BeaverTail (loader documented in PolinRider).

  loader documented in PolinRider

• The OpenSourceMalware Show #22
  talkas threat actors2026-09-25

  Malware family cited as one of the two ancestors of the new WeaselBiscuit malware.

• WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials
  writeupas threat actors2026-09-17

  DPRK-linked JavaScript (also ported to Qt/native) infostealer delivered via fake-interview lures and malicious npm packages; has wallet-draining, password decryption, seed-phrase regex sweep, InvisibleFerret handoff, file exfiltration; used as comparison baseline for WeaselBiscuit.

• The OpenSourceMalware Show #21
  talkas classification.key entities2026-09-17
• OpenSourceMalware Blog
  articleas classification.key entities2026-07-18
• PolinRider Jumps the Fence to Go, Packagist, npm, PyPI
  writeupas threat actors2026-07-08

  Lazarus toolkit loader that fingerprints the host OS and selects an InvisibleFerret implant; delivered via the PolinRider JavaScript loader chain.

• OpenSource Malware: Active Malware Campaigns in January-May 2026
  writeupas classification.key entities2026-06-12
• Active Malware Campaigns in January-May 2026
  writeupas classification.key entities2026-06-08
• Socket: Famous Chollima Targets PHP Developers via Compromised Packagist Package
  writeupas threat actors2026-06-01

  DPRK-linked malware family (BeaverTail-family payloads / BeaverTail variant) delivered via the same loader architecture per OpenSourceMalware's PolinRider reporting

• VSCode Lifecycle Script Malware
  writeupas threat actors2026-05-16

  Multi-stage loader malware deployed via the Fake Font campaign's tasks.json execution

• DeepTeam
  repoas classification.key entities2026-05-07
• knowledgator/opir-multitask-large-v1.0 · Hugging Face
  toolas classification.key entities