Do Son 
At a glance
| Actor | DPRK-linked group (Sapphire Sleet, Stardust Chollima, BlueNoroff, UNC1069) |
| Activity | NPM supply chain compromise via maintainer social engineering |
| Targets | Users of the axios, debug, chalk, and typo-crypto packages |
| Scale | axios sees 100M+ weekly downloads; ~1 in 10 cloud environments hit by debug/chalk |
| Status | Vendor attribution, medium confidence; no arrests |
| Source | Amazon Threat Intelligence (CJ Moses) |
TL;DR
Amazon has tied a string of open-source supply chain attacks to one DPRK-linked group. The same actor compromised the axios, debug, chalk, and typo-crypto NPM packages. Amazon assesses the link with medium confidence, and the goal appears financial.
What happened
Amazon Threat Intelligence traced four NPM compromises to a single operator. The group did not exploit a software bug. Instead, it socially engineered trusted package maintainers, then pushed a malicious update.
Any project that auto-updated pulled the poisoned version. As CJ Moses, CISO of Amazon Integrated Security, put it, “They didn’t break through a window.” The attackers walked in through trust.
The timeline shows a clear ramp. In March 2025, the group trojanized the small typo-crypto package. By September 2025, it hit the far larger debug and chalk libraries. In early 2026, the same playbook struck axios.
This pattern echoes the 2024 XZ Utils backdoor. In each case, a patient attacker spent months earning trust before striking.
A dress rehearsal
Amazon calls typo-crypto a testing ground. The malicious file, core.js, posed as the well-known core-js package. It fetched a second-stage payload from an attacker server and tailored itself to Windows, macOS, or Linux. Amazon reported it to the OSV database as MAL-2026-3400.
Who is behind it
Amazon attributes the campaigns to a North Korean actor with medium confidence. The security community tracks it under many names, including Sapphire Sleet, Stardust Chollima, and BlueNoroff. Google labels a linked cluster UNC1069.
The axios compromise was already public. But Amazon is first to tie typo-crypto, debug, and chalk to the same group. Its assessment rests on shared C2 indicators and reused tradecraft.
Impact and scale
The math favors the attacker. By poisoning a few popular packages, the group reaches thousands of downstream victims at once. Axios alone draws more than 100 million weekly downloads.
The blast radius can be huge. Wiz Research found that roughly 1 in 10 cloud environments met the debug and chalk compromise within a two-hour window.
How the tradecraft is shifting
These open-source supply chain attacks are also getting harder to spot. Amazon says attackers now split one malicious workflow across several harmless-looking packages. Each part passes review alone, and the harm appears only when they run together.
Some libraries stay clean on the registry yet still turn dangerous. Their real behavior lives on servers the attacker controls. Flip that remote content, and every install can turn hostile at once.
Payloads have grown stealthier too. Attackers now wrap them in real encryption, so a static review cannot read the code. Others watch for sandbox signals and stay quiet during analysis.
The mindset has changed on defense. As Amazon put it, “A year ago, we looked for malicious packages.” Now the team hunts for malicious behavior spread across a dependency graph.
AI raises the stakes
Generative AI erases old tells like broken English and thin documentation. It also enables “slopsquatting,” where attackers register package names that an AI assistant invented. A developer who trusts that suggestion can pull malware.
Amazon warns of a sharper twist: malware aimed at the machines that review code. In its words, “They’re writing malware for AI reviewers to approve.” Hidden prompt injection may soon ride inside packages to fool AI scanners.
How to stay protected
Pin dependencies and review updates before you adopt them. Watch post-install scripts, and isolate builds from production secrets. Rotate any credentials a compromised package could have reached.
Read Amazon’s full supply chain report for indicators and detection tips. So far, no law-enforcement action has been announced against this group.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
