Amazon Attributes Four NPM Supply-Chain Attacks to North Korean…

Amazon Threat Intelligence links the compromise of axios, debug, chalk, and typo-crypto to a North Korean group tracked as SAPPHIRE SLEET, STARDUST CHOLLIMA, and BlueNoroff. The campaign spanned over a year and introduces a new tactic: attackers are training operations to evade AI-powered automated code review systems.

Amazon Threat Intelligence has attributed, with medium confidence, the compromise of four widely used NPM packages — typo-crypto, debug, chalk, and axios — to a North Korean hacking group. The announcement, published July 29, 2026, documents a campaign spanning more than a year — from March 2025 to March 2026 — and introduces a critical shift: attackers are no longer just exploiting open-source community trust, they are training their operations to evade AI-augmented automated review systems as well.

Key Takeaways

Amazon attributes the compromises of typo-crypto (March 2025), debug and chalk (September 2025), and axios (March 2026) to a North Korean actor tracked as SAPPHIRE SLEET, STARDUST CHOLLIMA, and BlueNoroff.
Malicious packages trigger payloads via a conditional hash-based mechanism, download code from a hardcoded C2, and adapt execution to the victim's OS: Windows, macOS, or Linux.
Attackers distribute the malicious workflow across multiple seemingly benign packages: one holds the encrypted blob, a second the decryption logic, a third the payload fetch and execution.
Amazon flags the emergence of "slopsquatting": pre-registration of package names hallucinated by AI coding assistants, with hidden instructions in comments and READMEs that manipulate AI reviewers.

The Method: From Single Compromise to "Fragment-Level Attack"

The first documented compromise dates to March 2025: the typo-crypto package hosted a trojanized core.js file with SHA256 hash 2014d09c7ded74d89c885b5f11693865224116f1b25df9330e61fe528f419d73. The activation mechanism depends on an input hash beginning with the sequence 0098273; only when this condition is met does the malware contact the hardcoded C2 server and download the OS-specific payload.

Obfuscation follows a multi-layered path: base64 encoding followed by XOR cipher with a fixed key of 01042025. This architecture does more than hide code — it segments the compromise chain into phases distributed across distinct packages. Amazon Inspector observed that one package contains the encrypted blob, a second implements the decryption routine, and a third handles retrieval and execution of the final payload. None of the individual elements appears malicious in isolation; the threat emerges only from the dependency graph.

Seven months later, in September 2025, the same playbook hit debug and chalk, two foundational utilities in the Node.js ecosystem. Wiz Research quantified the impact: roughly one in ten cloud environments was compromised within two hours during that incident. In March 2026 came axios, with over 100 million weekly downloads, expanding the operation's potential reach to a substantial slice of global JavaScript infrastructure.

Social Engineering as a Technical Prerequisite

In every documented case, attackers socially engineered a trusted maintainer before publishing the malicious update. This is not typo-squatting or external impersonation: the actor seized control of the legitimate release process, exploiting the culture of openness that characterizes open-source maintenance.

Rick Anthony, senior manager at Amazon Inspector, described the dynamic precisely: "Quite frankly, the open-source community is looking for good citizens because these packages are often not maintained by people who are getting paid to do that as a full-time job... They are very welcoming for anyone who is willing to contribute." This structural willingness has become a systemic attack vector.

Attribution to a North Korean group rests on shared TTPs, common C2 indicators, and code reuse. Amazon rates confidence as "medium" — a level that rules out unproductive overlap with other documented actors at present, but does not claim judicial certainty on operator identity.

The AI-Driven Transition: From Malware That Deceives Humans to Malware That Deceives AI

The qualitative shift Amazon flags concerns not just scale, but the interlocutor. Generative AI is altering what malicious software looks like and how threat actors probe AI-based code review systems. Amazon Threat Intelligence has observed three converging vectors.

First: generation of synthetic code, documentation, and maintainer identities, with mutation, renaming, and re-encryption capabilities that deprive antivirus of stable signatures. Second: slopsquatting — the pre-emptive registration of package names produced by AI coding assistant hallucinations, with a direct malware delivery mechanism. Third: adversarial manipulation via hidden instructions in comments, READMEs, and docstrings that steer automated AI reviewers.

"A year ago, we looked for malicious packages. Today, we look for malicious behaviors split across packages that appear harmless on their own" — Amazon Threat Intelligence / Amazon Inspector

This transition demands a redesign of security tooling. Traditional scanners, optimized for single-package analysis, lose effectiveness against patterns distributed across dependency graphs. Amazon has responded with a $12.5 million donation to the Linux Foundation's Akrites initiative, aimed at developing open-source defenses against AI-augmented attacks.

The Geopolitical Calculus: Efficiency as a Revenue Multiplier

CJ Moses, Amazon's CISO, framed the operation in the context of international sanctions: "For a sanctions-constrained regime, generating revenue through these operations means that the greater the efficiency, the more money they get, and the more that they can use that money to do things that got them the sanctions to begin with." The financial motive is not inferred from the target but stated explicitly: simultaneous access to thousands of downstream environments maximizes the return per compromise.

Moses added an operational projection: "One successful supply chain compromise can yield access to hundreds, if not more, targeted intrusions." The supply chain is no longer just a distribution vector but a cascade-access generator, where each compromised package acts as an attack-surface multiplier for subsequent intrusions.

What to Do Now

Amazon has not issued specific operational guidance for users of the compromised packages; the brief does not document prescribed remediation actions from the source. The dossier focuses on technique description and attribution, leaving several critical points open for those managing open-source dependencies.

The degree of AI automation actually employed by attackers remains unquantified: Amazon describes observed capabilities and trends but does not establish what percentage of the campaign is generated by language models versus traditional techniques. No infrastructure overlaps link this specific group to other as-yet-unpublic NPM incidents. The precise number of compromised organizations beyond Wiz's 10% cloud-environment estimate is not disclosed.

Outstanding questions include: the status of any law enforcement investigations (FBI, DoJ) into this specific campaign; the exact proceeds generated; and whether corrected package versions exist that users can identify via official hashes or signatures. The OSV identifier MAL-2026-3400 is associated with typo-crypto, but no separate CVEs are documented for debug, chalk, or axios.

The public evidence describes an actor that has learned to exploit the very architecture of open-source collaboration, now augmented by AI intermediation. For those running NPM-dependent infrastructure, the takeaway is clear: single-package verification is no longer sufficient. The analysis surface has shifted to the graph of inter-package relationships, and to who controls the entry mechanisms into the maintenance chain.

Information verified against cited sources and current as of publication.

Sources

Sources and references