AWS Attributes Recent Attacks on npm Libraries to North Korean Hacker Group
In a significant development concerning cybersecurity, Amazon Web Services (AWS) has attributed a series of compromises involving popular npm libraries—most notably axios—to North Korean threat actors. This revelation was made in a detailed blog post published on July 29. The AWS Threat Intelligence team identified a common thread in the attacks targeted at various libraries, including axios, debug, chalk, and typo-crypto, attributing these malicious activities to a group recognized under several names, notably Saphire Sleet and BlueNoroff.
According to AWS, the connection between these incidents was established after a thorough analysis of the tactics, techniques, and procedures (TTPs) used in the attacks. CJ Moses, the Chief Information Security Officer (CISO) and Vice President of security engineering at Amazon, explained that the Amazon Threat Intelligence team had detected shared TTPs across these supply-chain attacks. These included the Trojanization of npm packages, utilization of post-install hooks—scripts that execute automatically upon package installation—and a notable recurrence of code reuse among the malicious updates.
Moses commented, “Based on our analysis of command-and-control (C2) indicators and TTPs, Amazon Threat Intelligence assesses with medium confidence that these campaigns are attributable to the DPRK-linked threat actor tracked as Saphire Sleet.” This attribution alleges that the attacks were not random but rather calculated maneuvers orchestrated by North Korean hacktivists, reflecting a methodical approach to compromising open-source software infrastructure.
All instances of the attacks employed a consistent operational playbook. The hacker group initiated these attacks through social engineering tactics aimed at package maintainers. Once they successfully manipulated a maintainer, they published a software update infused with malicious code. This tactic created a scenario where any organization that automatically incorporated these versions received compromised updates, thus broadening the impact of the attack.
Reflecting on the timeline of these attacks, Moses indicated that the compromise of the typo-crypto package back in March 2025 served as a preliminary test for subsequent campaigns that yielded far-reaching consequences. Notably, around 10% of cloud environments experienced adverse effects from the debug and chalk supply chain attacks within a mere two-hour window. Additionally, axios is highly regarded within the programming community and boasts over 100 million weekly downloads, meaning the stakes were high. “By targeting a limited number of highly prevalent packages, the group can gain potential access to thousands of downstream environments in one fell swoop,” Moses elaborated. “This method is considerably more efficient for financially motivated threat actors compared to attacking individual organizations sequentially.”
AWS has also elaborated on the shifting landscape of attacker methodologies and TTPs in relation to open-source libraries. Moses pointed out several evolving strategies that malicious actors are employing, which include:
- Splitting Malicious Workflows: Attackers now often divide a single harmful workflow across multiple appearing innocuous packages, complicating detection efforts.
- Prolonged Presence: These threat actors tend to adopt the persona of legitimate maintainers over extended periods, only publishing their malicious updates after weeks or months of establishing credibility.
- Benign Package Contents: While the immediate contents of the packages may appear harmless, the insidious aspect often lies in the external scripts and configuration files linked to them.
- Advanced Obfuscation Techniques: Malware obfuscation is becoming increasingly sophisticated. Techniques now include employing AES-GCM encrypted blobs secured by passphrases and sophisticated layering methods such as XOR over base64.
- Evasive Payloads: The payloads being deployed have been designed to elude sandbox analysis effectively.
- Slopsquatting Techniques: Attackers are also resorting to slopsquatting, a tactic involving the registration of package names generated incorrectly by AI coding tools to capture an increased number of victims.
Despite AWS’s insights into the evolving methodologies of cyber attackers, Cris Thomas, a security advocate at Semgrep, raised concerns regarding the attribution of these attacks, suggesting it may be best left to governmental and law enforcement agencies. “Defenders should not overly fixate on the identity of the attackers. Instead, they should prioritize understanding the likely techniques employed by a specific adversarial group,” Thomas suggested. He went further to emphasize the importance of robust security practices, stating, “The objective should not be about thwarting every successful attack but rather about rapidly identifying, limiting, blocking, and rectifying any breaches as they occur.”
This situation underscores the pressing need for vigilance among organizations that utilize open-source libraries, particularly as the sophistication of cyber threats continues to escalate. With adversaries developing nuanced strategies, it remains crucial for security teams to adapt and fortify their defenses accordingly.