WeaselBiscuit Stealer: 13 Malicious npm Packages Target Chrome Extension Storage — Detection and Response Guide

---
title: Suspicious Child Process Spawned by npm or Node During Install
tid: 3f8a2c14-7b9d-4e61-a502-8c1d9e4f7a23
status: experimental
description: Detects npm/npx/node spawning shells, downloaders, or script interpreters during package install — consistent with malicious lifecycle-script abuse seen in WeaselBiscuit and BeaverTail-style npm supply-chain attacks.
references:
  - https://thehackernews.com/2026/09/weaselbiscuit-stealer-spreads-via-13.html
  - https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
date: 2026/09/19
tags:
  - attack.initial_access
  - attack.t1195.002
  - attack.execution
  - attack.t1059.007
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.cmd'
      - '\npx.cmd'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\curl.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate native-module builds (node-gyp) can spawn cmd.exe during install; tune by build-server OU or known-good package allowlist
level: high
---
title: Non-Browser Process Accessing Chrome Extension Storage
tid: 9d41b7e6-2c83-4f15-b890-5a3e7d1c6f92
status: experimental
description: Detects any process other than the browser reading Chrome/Chromium extension LevelDB storage. Extension storage holds wallet keys, session tokens, and cached credentials — the primary collection target of the WeaselBiscuit stealer. Near-zero legitimate non-browser access.
references:
  - https://thehackernews.com/2026/09/weaselbiscuit-stealer-spreads-via-13.html
  - https://attack.mitre.org/techniques/T1555/003/
author: Security Arsenal
date: 2026/09/19
tags:
  - attack.credential_access
  - attack.t1555.003
  - attack.collection
  - attack.t1005
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Local Extension Settings\'
      - '\Sync Extension Settings\'
  selection_ext:
    TargetFilename|endswith:
      - '.log'
      - '.ldb'
      - '.sst'
  filter_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\opera.exe'
  condition: selection_path and selection_ext and not filter_browser
falsepositives:
  - Enterprise DLP or EDR content-inspection drivers; validate and exclude by signer, never by path
level: critical
---
title: Node.js Script Reading Browser Profile Directories
tid: 5c27e0a4-8f36-4d09-a174-2b9c6e83f015
status: experimental
description: Detects node.exe executing scripts that reference Chromium browser profile or extension-storage paths — a hallmark of JavaScript stealers such as WeaselBiscuit harvesting extension data from disk.
references:
  - https://thehackernews.com/2026/09/weaselbiscuit-stealer-spreads-via-13.html
  - https://attack.mitre.org/techniques/T1059/007/
author: Security Arsenal
date: 2026/09/19
tags:
  - attack.credential_access
  - attack.t1555.003
  - attack.execution
  - attack.t1059.007
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith: '\node.exe'
  selection_cli:
    CommandLine|contains:
      - 'Local Extension Settings'
      - 'Sync Extension Settings'
      - 'Google\\Chrome\\User Data'
      - 'Microsoft\\Edge\\User Data'
      - 'leveldb'
  condition: selection_image and selection_cli
falsepositives:
  - Rare; internal tooling that audits browser extension inventories should be renamed/allowlisted explicitly
level: critical

let Lookback = 7d;
let BrowserProcs = dynamic(["chrome.exe","msedge.exe","brave.exe","opera.exe"]);
let InstallExec =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where InitiatingProcessFileName in~ ("node.exe","npm.cmd","npx.cmd")
    | where FileName in~ ("powershell.exe","pwsh.exe","cmd.exe","curl.exe","wscript.exe","cscript.exe","mshta.exe","certutil.exe","bitsadmin.exe")
    | project InstallTime=Timestamp, DeviceId, DeviceName, InitiatingProcessCommandLine, SpawnedProcess=FileName, SpawnedCommandLine=ProcessCommandLine, AccountName;
let StorageRead =
    DeviceFileEvents
    | where Timestamp > ago(Lookback)
    | where FolderPath has_any ("Local Extension Settings","Sync Extension Settings")
    | where FileName has_any (".log",".ldb",".sst")
    | where not(InitiatingProcessFileName in~ (BrowserProcs))
    | project ReadTime=Timestamp, DeviceId, DeviceName, ReaderProcess=InitiatingProcessFileName, ReaderCommandLine=InitiatingProcessCommandLine, TargetPath=FolderPath, FileName, AccountName;
let NodeNet =
    DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where InitiatingProcessFileName =~ "node.exe"
    | where RemotePort in (443, 80)
    | summarize FirstSeen=min(Timestamp), Connections=count(), Destinations=make_set(RemoteUrl, 25) by DeviceId, DeviceName, InitiatingProcessCommandLine;
union InstallExec, StorageRead
| join kind=leftouter (NodeNet) on DeviceId
| summarize arg_max(coalesce(InstallTime, ReadTime), *) by DeviceId, coalesce(InitiatingProcessCommandLine, ReaderCommandLine)
| order by coalesce(InstallTime, ReadTime) desc

-- Hunt: WeaselBiscuit-style extension-storage theft
-- Identifies Node processes referencing browser profile paths and enumerates
-- wallet-extension LevelDB stores present on disk (potential collection targets).
LET node_sus = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)node|npm|npx'
  AND CommandLine =~ '(?i)(Local Extension Settings|Sync Extension Settings|User Data|leveldb|nkbihfbeogaeaoehlefnkodbefgpgknn|bfnaelmomeimhlpmgjnjophhpkkoljpa)'

LET wallet_stores = SELECT FullPath, Size, Mtime
FROM glob(globs='C:/Users/*/AppData/Local/Google/Chrome/User Data/*/Local Extension Settings/*/*.ldb')
WHERE FullPath =~ '(?i)(nkbihfbeogaeaoehlefnkodbefgpgknn|bfnaelmomeimhlpmgjnjophhpkkoljpa|hnfanknocfeofbddgcijnmhnfnkdnaad)'

SELECT 'suspicious_node_process' AS FindingType,
       format(format='%v', args=node_sus) AS Detail,
       '' AS WalletStorePath
FROM node_sus
UNION ALL
SELECT 'wallet_extension_store_present' AS FindingType,
       format(format='mtime=%v size=%v', args=[wallet_stores.Mtime, wallet_stores.Size]) AS Detail,
       wallet_stores.FullPath AS WalletStorePath
FROM wallet_stores

#!/usr/bin/env bash
# weaselbiscuit-repo-audit.sh — audit npm projects for supply-chain risk indicators
set -euo pipefail

REPO="${1:-.}"
echo "=== Auditing $REPO for npm supply-chain risk indicators ==="

# 1. Flag packages declaring install-time lifecycle hooks (WeaselBiscuit's execution vector)
echo "--- [1] Dependencies with preinstall/install/postinstall hooks ---"
if [ -f "$REPO/package-lock.json" ]; then
  grep -nE '"(preinstall|install|postinstall)"' "$REPO/package-lock.json" || echo "none in lockfile"
fi
find "$REPO/node_modules" -maxdepth 3 -name package.json 2>/dev/null \
  | xargs grep -lE '"(preinstall|install|postinstall)"' 2>/dev/null || echo "node_modules not present or no hooks found"

# 2. Flag non-registry dependency sources (git URLs, tarballs, file: refs)
echo "--- [2] Non-registry dependency sources in manifests ---"
grep -nE '"[^"]+":\s*"(git\+|git://|https?://|file:)' "$REPO/package.json" 2>/dev/null || echo "none"

# 3. Surface recently published / recently added transitive deps for review
echo "--- [3] Lockfile packages resolved in last 30 days (review newest first) ---"
find "$REPO" -name package-lock.json -mtime -30 -print

# 4. Registry audit and signature check
echo "--- [4] npm audit + registry signature verification ---"
( cd "$REPO" && npm audit --audit-level=moderate || true )
( cd "$REPO" && npm audit signatures 2>/dev/null || echo "signature audit not supported on this npm version" )

# 5. Check for install-script execution evidence in shell history / CI logs
echo "--- [5] Reminder: run installs with scripts disabled ---"
echo "    npm ci --ignore-scripts   # default posture for CI"
echo "    Verify allowlisted native builds explicitly (node-gyp, esbuild, etc.)"