Threat investigators connect four previous npm library breaches affecting axios, debug, chalk, and typo-crypto packages, to a single source.
After investigating a series of seemingly unrelated high-profile open-source software attacks on open-source software packages, Amazon’s threat-intelligence unit has established that four previous attacks can be linked to a single North Korean hacking group.
The firm has announced that the breaches of four Node Package Manager (npm) libraries — axios, debug, chalk, and typo-crypto — can be traced to a cluster of aliases linked to Pyongyang: Sapphire Sleet, Stardust Chollima, BlueNoroff, CageyChameleon, and Alluring Pisces.
Starting in March 2025, the North Korean threat group had seeded a trojanized file named core.js inside the small, little-used open source typo-crypto package, masquerading it as the legitimate core-js library and activating only when it detected a specific numeric input before reaching out to an attacker-controlled server to fetch a second-stage payload tailored to Windows, macOS, or Linux. It is now believed to have been a dry run for the subsequent attacks.
Six months on, in September 2025, the same playbook had been used against debug and chalk, two widely-used logging and styling utilities. According to some reports, roughly one in 10 cloud environments had been affected within a two-hour window.
The campaign then culminated in March 2026 with the compromise of axios, a ubiquitous HTTP client library downloaded more than 100m times each week, which had already been linked to the North Korean cluster tracked as UNC1069.
In each case, the attackers did not break in through technical vulnerabilities but instead had cultivated relationships with trusted maintainers who already had publishing rights. This was exploited to push malicious updates containing hidden code. A spokesperson said the threat actors had basically earned the trust of an employee “to hand them the keys.” Also, the investigations have found that the attackers had used generative AI to:
- draft and obfuscate payloads
- apply execution gating to evade sandboxes
- probe AI-based code-auditing tools
- create synthetic maintainer identities
- exploit “slopsquatting” opportunities to hallucinate package names
The attribution to North Korean entities is tagged with “medium confidence” in geopolitical terms: implying that greater operational efficiency translates directly into more illicit revenue to fund further prohibited activities.
