Amazon Ties Four NPM Package Compromises, From typo-crypto to axios, to One North Korean Group

Amazon Threat Intelligence has linked four compromises of popular JavaScript packages on the NPM registry to a single North Korea-linked threat actor, tracked as SAPPHIRE SLEET, STARDUST CHOLLIMA, BlueNoroff, CageyChameleon and Alluring Pisces. Amazon made the attribution with medium confidence, based on command-and-control indicators and shared techniques, in a report on the AWS Security Blog last Wednesday.

The sequence runs over a year. The group hit the typo-crypto package in March 2025, the debug and chalk packages in September 2025, and axios, which has more than 100 million weekly downloads, in March 2026. The axios attack had already been attributed to North Korea: Google tied it to a group it tracks as UNC1069, and Microsoft to Sapphire Sleet, The Record reported. Amazon says the earlier three had never been publicly connected to the same actor.

In the debug, chalk and axios cases, the attackers socially engineered a trusted maintainer and then published an update containing malicious code, so any organization that automatically pulled the latest version got the compromised release. The links between the incidents include trojanized packages, post-install hooks that run automatically on installation, and reused code. Wiz Research found that roughly one in 10 cloud environments were affected by the debug and chalk incident within a two-hour window, Amazon noted.

A small test run

The typo-crypto compromise, which Amazon found while tracing a domain registered in 2025, looks like a rehearsal. A trojanized file named core.js posed as the legitimate core-js package. It fires when it receives a hash input beginning with 0098273, downloads a second-stage payload tailored to Windows, macOS or Linux, and uses file-based persistence and layered obfuscation combining base64 with an XOR cipher. Download numbers were low, and Amazon assesses the campaign was a testing ground. It reported the malware to the Open Source Vulnerabilities database as MAL-2026-3400.

How the tactics are changing

Amazon described several broader shifts it has seen in attacks on open-source libraries. Attackers increasingly split one malicious workflow across several harmless-looking packages, so that scanners checking packages one by one see nothing. Some maintain useful packages for weeks or months to build trust before acting. Others keep a package clean on the registry while its behavior depends on external resources the attacker can later switch to malicious. Payloads now use stronger cryptography, such as AES-GCM encrypted blobs, and check whether they are running in an analysis sandbox before acting.

“A year ago, we looked for malicious packages. Today, we look for malicious behaviors split across packages that appear harmless on their own,” Amazon wrote.

Generative AI is part of the change, according to the report. It lets attackers produce coherent, well-documented code around a backdoor and mutate each variant so no single signature matches. Amazon also pointed to slopsquatting, registering package names that AI coding assistants hallucinate, and said it expects hidden prompt-injection instructions aimed at AI-based code scanners to show up in malicious packages.

North Korea stole more than $2 billion in cryptocurrency in 2025, its largest annual haul on record, The Record noted. Amazon said it has shared the indicators with Amazon GuardDuty to alert customers, and that AWS helped the Linux Foundation and others launch the Akrites initiative and co-invested $12.5 million with other organizations to defend open-source software from AI-driven attacks.