WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials

OpenSourceMalware researchers describe "WeaselBiscuit," a lightweight Node.js infostealer hidden in multiple malicious npm packages that fetch a Base64 second-stage from api.npoint.io, executes it in memory, and exfiltrates Chrome extension LevelDB data, clipboard contents, and Windows keystrokes to an Express C2 at 103.170.217.184:8787; the report provides package names, Npoint resolver URLs, a second-stage SHA-256, recommended investigative actions, and tentatively links the tooling to DPRK-associated BeaverTail/OtterCookie tradecraft while noting reduced capabilities and limited persistence.