DPRK-Linked npm Campaign Harvests Chrome Extension Data via 13 Packages

Key points

• 13 malicious npm packages linked to DPRK's Contagious Interview operation
• Payload chain includes WeaselBiscuit, BeaverTail, and InvisibleFerret
• Stealer focuses on Chrome extension storage, enabling credential and session theft
• No CVE assigned; detection hinges on package and behavioral indicators
• OpenSourceMalware disclosed the campaign in September 2026

In September 2026, analysts at OpenSourceMalware connected a cluster of thirteen npm packages to a North Korean intrusion set known as Contagious Interview. Rather than exploiting a software flaw, the operators published tainted dependencies that execute a JavaScript-based stealer when installed. The activity has no assigned CVE because the abuse relies on trust in the open-source supply chain, not a patchable vulnerability.

The toolchain observed in this campaign includes WeaselBiscuit, BeaverTail, and InvisibleFerret. Those components work together to profile the victim, exfiltrate data, and maintain a foothold. The stealer's distinctive focus is Chrome extension storage, where browser add-ons often keep authentication tokens, session identifiers, and other sensitive values. Once that data is taken, attackers can impersonate users, pivot into connected services, and enable further data theft or financial fraud.

Developers and organizations that pulled the affected packages are the primary exposure group. Because JavaScript ecosystems underpin countless internal tools and public-facing services, a single compromised dependency can ripple into build pipelines, CI runners, and production environments. For public-sector and education technology teams, which frequently rely on community packages for speed, the risk is less about a single laptop and more about downstream access to shared repositories and cloud tenancy.

Contagious Interview has historically blended social engineering with developer-focused lures, and this npm-based delivery fits that pattern. The absence of a CVE means traditional vulnerability scanners will not flag the issue; defenders must instead watch for malicious package names, unusual post-install scripts, and outbound connections tied to the named tools. Signature coverage may lag as packages are republished or renamed.

What to watch: fresh npm publications from the same actor set, updates to OpenSourceMalware's reporting, and any suspicious browser extension behavior on developer endpoints. Teams should treat extension storage as sensitive credential material and review dependency provenance before the next install.

What to do now

1. Immediately inventory dependency manifests and lockfiles for the 13 identified npm packages, then remove or pin to safe versions.
2. Rotate all credentials, API keys, and session tokens that could have been stored in Chrome extension storage on affected developer machines.
3. Enforce a private npm proxy or allowlist so unvetted public packages cannot be pulled directly into build pipelines.
4. Hunt for indicators of WeaselBiscuit, BeaverTail, and InvisibleFerret across endpoints, CI runners, and egress logs; isolate any hosts showing matching behavior.
5. Restrict browser extension installation through enterprise Chrome policy and audit existing extensions for excessive storage or network permissions.
6. Require lockfile integrity checks and post-install script review in CI, and subscribe to OpenSourceMalware advisories for updated package names.
7. Brief developers on Contagious Interview recruitment-style lures and reinforce reporting channels for suspicious package or recruiter contact.

Original source

The Hacker News