GCVE-110-OSM-2026-12149

This package delivers a new lightweight DPRK malware strain, "WeaselBiscuit". This strain appears to be loosely modelled on OtterCookie, but with many of OtterCookies functions removed. This is how simple this malware is: 1. It hides in an npm package 2. When the package is imported, it quietly starts a background Node.js process. 3. That process downloads the real malware code from Npoint. 4. The malware asks another Npoint URL for its real command server 5. It sends the attacker basic information about the computer: - username and computer name - operating system, CPU, memory - public IP address and approximate location - local IP addresses and MAC addresses 6. It copies readable Chrome extension data, including possible cryptocurrency-wallet extension data. 7. Every five seconds, it asks the attacker’s server whether to start stealing clipboard contents. 8. If told yes, it sends copied text to the attacker—potentially passwords, API keys, wallet addresses, or recovery phrases. 9. Every five seconds, it asks whether to turn on keylogging. 10. If told yes and running on Windows, it creates a temporary PowerShell keylogger and uploads typed keystrokes. 11. It does not directly steal saved Chrome passwords/cookies, take screenshots, run a remote shell, download Python malware, or persist after reboot in the recovered code. ENTRY index.js (main: index.js) On require/import, index.js unconditionally calls initialize(), which spawns a detached, unref'd `node loader.js` child with stdio ignored and writes a PID file. loader.js fetches JSON from a npoint.io endpoint (a mutable third-party paste endpoint), base64-decodes the `code` field, and executes it via `new Function('require','__dirname','__filename','module','exports', decodedCode)(...)`, granting the remote endpoint operator arbitrary code execution on the installer's host. The remote URL is stored in a constant misleadingly named `API_KEY` and surrounded by comments describing the loader as a sandboxed educational component, contradicting the actual fetch-decode-eval behavior. DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Payload Download from Paste Service in loader.js: "npoint.io" - Network Request in loader.js: "https.get(" - System Information Collection in loader.js: "process.platform" OBFUSCATION - Global Variable Shadowing in loader.js: "const module = {" - Dynamic Base64 Decoding in loader.js: "Buffer.from(code, "base64")" - Deobfuscation Failed in loader.js ADDITIONAL FINDINGS - Chai-Max Cryptocurrency Stealer in loader.js: "npoint.io/24c25d5f" - Silent Process Execution in init.js: "windowsHide: true" - Detached Child Process Payload in init.js: "spawn('node', [LOADER], { stdio: ['ignore', 'ignore', 'ignore'], windowsHide: tr..." - Dynamic Code Execution in loader.js: "new Function("require", "__dirname", "__filename", "module", "exports", decodedC..." - Shell Command Execution in loader.js: "require('child_process')" - Shell Command Variable Setup in loader.js: "win32") { const { spawnSync } = require('child_process'); const result = spawnSy..." (+3 more) PAYLOAD FILES loader.js