OpenSourceMalware found 11 malicious npm packages delivering WeaselBiscuit, a compact Node.js infostealer that executes an Npoint-hosted payload in memory and communicates with an HTTP C2 at 103.170.217.184:8787. It profiles infected systems, steals Chrome extension storage, and can collect clipboard contents and Windows keystrokes when enabled by the operator. The researchers tentatively link it to DPRK-associated Contagious Interview tradecraft because of its npm delivery, Npoint dead drops, data targets, and operational patterns, while noting major differences from BeaverTail and OtterCookie. The attribution remains low to moderate confidence because exclusive infrastructure, victimology, and conclusive shared-code evidence are absent.