Amazon links four poisoned npm packages to one North Korean crew

Amazon has linked the compromises of four npm packages over the past 18 months, saying they were all the work of the same North Korean crew. In research published this week, AWS attributed the activity with medium confidence to the North Korea-linked group tracked as Sapphire Sleet, which is widely regarded as a Lazarus Group offshoot. Rather than exploiting zero-days or hacking npm itself, the crew allegedly took the slower route of befriending maintainers, stealing credentials, and publishing poisoned updates from accounts that developers already trusted. The research revisits the compromises of typo-crypto, chalk and debug, and Axios, concluding that the four packages were targeted by the same North Korean operation. Google had already attributed the Axios compromise to Sapphire Sleet, which it tracks as UNC1069, but Amazon goes further, saying the same group was behind all four incidents. The company points to shared infrastructure and technical overlaps, alongside similarities in how the attacks were carried out and which packages were targeted. Rather than attacking npm's infrastructure, the group allegedly went after the people trusted to publish code. Once a maintainer account was compromised, malicious releases could be pushed through the same channels developers use every day. AWS says the targets also grew more ambitious, progressing from little-known packages to some of the ecosystem's biggest names. AWS says this strategy is as much about economics as espionage. Instead of picking off victims individually, compromising a small number of widely used packages offers a shot at thousands of downstream environments in one go. AWS warns that generative AI is making this kind of operation easier to sustain by helping attackers create believable developer personas, tailor messages to individual maintainers, and keep long-running social engineering campaigns convincing enough to earn their targets' trust. "Attackers can now produce thousands of lines of coherent, idiomatic, well-commented code, complete with convincing documentation, plausible commit histories, and synthetic maintainer identities, wrapped around a backdoor," said CJ Moses, AWS CISO. "Because each variant can be mutated, renamed, restructured, and re-encrypted, there is no single stable signature to match. Pattern-based detection loses ground against malware that looks one of a kind in every deployment." Amazon's findings build on what's already known about Sapphire Sleet. The group has long been associated with cryptocurrency theft, fake job offers, and elaborate social engineering campaigns aimed at developers. Amazon argues that the group has adapted its established methods to target the software supply chain. Whether other researchers will agree that all four compromises belong to the same operation remains unclear. If AWS is correct, the incidents trace the group's progression from an obscure package with few downloads to dependencies used across millions of projects. (R)