Amazon Links North Korean Hacking Group to Coordinated Open-Source Supply Chain Campaign

Amazon Threat Intelligence has identified a coordinated campaign by a North Korean state-sponsored hacking group targeting the global open-source software supply chain. By linking four major JavaScript package compromises—typo-crypto, debug, chalk, and axios—researchers revealed an industrial operation active since early 2025. The attackers utilized social engineering to gain the trust of package maintainers, allowing them to inject malicious code into libraries that receive hundreds of millions of weekly downloads. This campaign aims to gain broad access to downstream enterprise systems to generate revenue for the North Korean regime, bypassing international sanctions and funding military programs.

// Background

Open-source software relies on a trust-based model where volunteer maintainers often lack the resources to vet every contribution. North Korea has a long history of using cyber operations, including cryptocurrency theft and IT worker infiltration, to sustain its economy under global sanctions. The 2024 XZ Utils backdoor incident previously highlighted the extreme risk of long-term social engineering in open-source projects.

// Key Developments

• Attributed the campaign to the North Korean group tracked as Sapphire Sleet, BlueNoroff, or APT38.
• Identified compromises in four widely used NPM packages: typo-crypto, debug, chalk, and axios.
• Axios alone has over 100 million weekly downloads, while debug and chalk exceed 1 billion combined.
• Attackers used social engineering to pose as legitimate contributors and gain maintainer access to publish malicious updates.
• Warned of 'slopsquatting,' where attackers exploit AI coding assistant errors to register and distribute malicious packages.
• Amazon launched the Akrites initiative with a $12.5 million investment to secure open-source software against AI-enabled threats.