Amazon Ties Years of npm Supply-Chain Attacks to North Korean Hacking Group
Amazon has attributed a series of high-profile attacks on the Node Package Manager (npm) open-source ecosystem to a North Korean state-linked hacking group, tying together incidents previously treated as separate events. The company’s security researchers linked the compromises of the typo-crypto, debug, chalk, and axios packages to the group tracked as Sapphire Sleet, also known in the industry as BlueNoroff or Stardust Chollima, with medium confidence based on shared infrastructure and operational patterns.
According to Amazon, the campaign began as early as March 2025 with the compromise of the lesser-known typo-crypto package, which researchers believe served as a testing ground for the group’s techniques. The operation escalated significantly in September 2025 when attackers compromised the debug and chalk libraries, two of the most widely used building blocks in the JavaScript ecosystem, together downloaded more than two billion times a week; the malicious update reportedly affected an estimated 10 percent of cloud environments within just two hours of release. In March 2026, the same actors were linked to the compromise of axios, a widely used HTTP client library with more than 100 million weekly downloads, in an attack that had already been publicly attributed to North Korea-linked operators but had not previously been connected to the earlier incidents.
Amazon said the attackers gained access primarily by socially engineering individual package maintainers before pushing malicious updates that were then distributed automatically to any project depending on the compromised libraries. The company’s researchers also flagged evolving tradecraft across the campaign, including splitting malicious functionality across multiple ostensibly benign packages, spending months building credibility as legitimate contributors before striking, delaying payload execution until a real production environment is detected, and registering package names that AI coding assistants are known to hallucinate — a technique known as “slopsquatting” — in the hope that developers or autonomous coding agents will install them unknowingly.
The financial motive behind the campaign, combined with its scale and persistence, illustrates how open-source software supply chains have become a preferred vector for state-linked cybercrime. Amazon said it is sharing its findings with the security community and has committed $12.5 million to an initiative aimed at protecting open-source infrastructure from AI-enabled supply-chain attacks.