Amazon linked multiple high-profile open-source software supply chain attacks targeting the Node Package Manager (npm) ecosystem to North Korean hackers.
The cloud computing giant linked the compromises of the typo-crypto, debug, chalk, and axios libraries to the Sapphire Sleet threat actor, also known as BlueNoroff and Stardust Chollima.
Initial activity started with trojanizing the typo-crypto package in March 2025, which Amazon believes served as a testing ground. It then escalated in September of the same year with the compromise of the widely used debug and chalk packages, affecting an estimated 10% of cloud environments within two hours.
In March 2026, the hacker targeted axios, one of npm’s most popular packages with over 100 million weekly downloads.
It should be noted that the axios incident has already been publicly attributed to DPRK-linked actors, but Amazon connected it to the earlier package compromises.
Amazon says the attacker gained access by socially engineering package maintainers, and then published malicious updates that were automatically distributed to unsuspecting users.
The attribution to Sapphire Sleet has medium confidence and is based on the shared tactics, techniques, and procedures (TTPs) observed in the campaign, the command-and-control (C2) infrastructure, and various operational similarities.
Also, the researchers believe the attacker had a financial motivation, targeting popular packages to gain indirect access to a large pool of potential downstream victims at once.
Amazon also highlights several trends that have emerged from the recent supply-chain attacks:
- Attackers are splitting malicious functionality across multiple seemingly benign packages, making detection more difficult.
- Threat actors are spending months building trust by maintaining legitimate projects or becoming contributors before introducing malicious code.
- Malicious behavior is increasingly decoupled from package contents, relying on external scripts, configuration files, or servers that can be weaponized later.
- Malware is using stronger encryption and multi-stage payloads, with runtime or remotely fetched keys that hinder static analysis.
- Payloads are becoming environment-aware, delaying execution unless they detect real developer or production environments to evade analysis sandboxes.
- Attackers are increasingly exploiting “slopsquatting” by registering package names hallucinated by AI coding assistants, hoping developers or autonomous coding agents will install them.
Many of these tactics are enhanced and simplified by AI, Amazon explains, as they help attackers generate code, documentation, and maintainer identities.
Amazon highlighted a multi-faceted response to these dangers, including reporting its findings and intelligence to the community, collaborating with OpenSSF and other industry partners, and investing $12.5M in the Akrites initiative, which helps protect critical open-source software from AI-enabled attacks.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
