Amazon links North Korean hackers to open-source supply chain attacks
Amazon Threat Intelligence has identified a North Korean-linked threat actor responsible for recent compromises of popular open-source Node Package Manager (NPM) libraries. This group, tracked under multiple aliases, has targeted widely used packages like axios, debug, and chalk, potentially affecting thousands of downstream environments. The analysis also highlights the evolving tradecraft of these attackers, including the use of generative AI and fragmented attacks across multiple packages, underscoring the ongoing risks to the open-source ecosystem.
- →North Korean threat actor linked to NPM package compromises
- →Attackers exploit trust in open-source maintainers
- →Evolving attacker techniques include AI and fragmented attacks
- →TYPO-CRYPTO campaign served as a precursor
- →AWS provides insights and tools for detection
Notes (5) ›
- North Korean threat actor linked to NPM package compromises
Amazon Threat Intelligence has linked a threat actor associated with the Democratic People’s Republic of Korea (DPRK) to compromises of the NPM packages typo-crypto, debug, chalk, and axios. This marks the first public attribution connecting these specific incidents to the DPRK-linked actor, known by various aliases including SAPPHIRE SLEET and BlueNoroff.
- Attackers exploit trust in open-source maintainers
The compromised NPM packages were updated with malicious code after the threat actor socially engineered trusted maintainers. This method allows attackers to reach a wide audience, as organizations that automatically update dependencies can ingest the compromised versions.
- Evolving attacker techniques include AI and fragmented attacks
The analysis reveals that threat actors are beginning to probe AI-based code systems and are shifting towards fragment-level attacks. This involves splitting malicious workflows across multiple seemingly benign packages, making detection more challenging as individual components appear harmless.
- TYPO-CRYPTO campaign served as a precursor
A campaign in March 2025 involving the typo-crypto package, which contained a trojanized file named core.js, is believed to have been a testing ground for the threat actor's supply chain techniques, predating the more impactful compromises of later 2025 and 2026.
- AWS provides insights and tools for detection
Amazon Web Services (AWS) is sharing this research to help the open-source community and security teams identify and address these threats. The Amazon Inspector team has reported the identified malware to the Open Source Vulnerabilities (OSV) database.
https://aws.amazon.com/blogs/security/amazon-identifies-north-korean-hacker-group-behind-open-source-supply-chain-attacks/
Related releases
- Terraform AWS Provider v6.60.0 Adds New Resources and Fixes Bugs Terraform AWS Provider Releases ·
- Amazon S3 enhances access denied errors with specific policy ARNs AWS What's New ·
- OpenAI Daybreak Red and Blue Cyber Defense Models Now on Amazon Bedrock AWS What's New ·
- AppFolio Transforms Data Streaming with Amazon MSK Express Brokers AWS Big Data Blog ·
- AWS IAM Role Manager Automates Service Role Setup AWS What's New ·
- Amazon Quick Integrates Microsoft Purview for Data Loss Prevention AWS What's New ·