North Korean group compromises multiple npm packages

A North Korean hacking group conducted a multi-year campaign compromising several widely used open-source software libraries, according to research from Amazon. The campaign, which began in March 2025, targeted the JavaScript packages typocrypto, debug, chalk, and axios through social engineering of trusted maintainers.

Amazon Threat Intelligence linked the four incidents to a single threat actor tracked under multiple names, including Sapphire Sleet, BlueNoroff, and Stardust Chollima. The company assessed the attribution with medium confidence. The group's method involved building relationships with package maintainers over weeks or months before using their publishing access to release malicious updates. Organizations that automatically installed these updates unknowingly downloaded malware.

The campaign started with the small typocrypto package in March 2025, which Amazon's chief information security officer, CJ Moses, described as a rehearsal. The attackers then compromised the more popular debug and chalk packages in September 2025. Researchers cited a finding that roughly one in ten cloud environments was affected by these two compromises within a two-hour window. The...