Amazon Associates npm Hacks with North Korean Threat Actor ‘Sapphire Sleet’
A recent analysis conducted by Amazon Web Services (AWS) indicates that a series of nefarious attacks targeting open-source libraries can be traced back to a financially-motivated North Korean threat actor, referred to as ‘Sapphire Sleet’ or ‘Stardust Chollima.’ This finding, which is set to be published imminently, highlights the increasing sophistication of supply-chain attacks, particularly in the realm of open-source software.
The report reveals that hackers have enhanced their methods for executing supply-chain attacks by infiltrating open-source software hosted on popular repositories. Specific platforms targeted include npm, which specializes in JavaScript packages, and PyPi for Python libraries. This trend has been evident at least since early 2024, beginning with the compromise of a widely used data compression software known as XZ Utils. This software breach brought attention to the concerning vulnerability within the ecosystem of open-source software.
Amazon has stated with medium confidence that the malicious actor responsible for these hacks is the same North Korean group known for compromising various JavaScript packages, including Axios, Debug, Chalk, and Typo-Crypto. CJ Moses, a vice president at Amazon engineering, underscored that the company holds a high level of confidence regarding North Korea’s involvement in these breach incidents. The primary issue remains whether the same group was behind all four hacks, which requires further independent verification.
Moses elaborated, stating, “We found one hand on the keyboard behind four different supply-chain attacks. When you connect these dots together, it starts looking more like an industrial operation.” This insight points toward a methodical approach taken by the hackers, exhibiting a level of organization typically associated with professional cybercriminal enterprises.
The attacks share several common characteristics, including the use of Trojanized npm packages and the implementation of repeated tactics, techniques, and procedures (TTPs). For example, the threats were often automated through scripts that execute whenever a user installs a package. This method allows North Korean hackers to effectively disguise their actions until it is too late for users.
In infiltrating these systems, North Korean hackers employed a unique strategy: they gained the trust of primary code maintainers by offering genuine assistance. Rick Anthony, a senior engineering leader at AWS, noted that these attackers successfully assimilated into the open-source community, addressing bugs, responding to pull requests, and even developing documentation for various projects. “These attackers look like good citizens within the open-source community,” he emphasized, reflecting the real concern that many legitimate developers are often on the lookout for trustworthy contributions, making them vulnerable to manipulation.
The npm repository has been marked as a particularly fertile ground for supply-chain attacks. Anthony pointed out that npm serves as a prevalent source of code for web applications due to its extensive user base and accessibility. The repository allows the hackers to target various components within the browser, including Web3 and cryptocurrency wallets, providing rich opportunities for exploitation.
A case example highlighted in the report is a March 2025 compromise of the Typo-Crypto package. Moses speculated that this incident may have served as a preliminary test for more ambitious attacks, including the more severe infiltration of Axios, which boasts over 100 million weekly downloads. “It was a small target that allowed them to test out TTPs without putting them on the big stage,” he said, illustrating the calculated nature of these hackers.
While highlighting the methodologies, the investigation also shed light on North Korea’s broader motivations. The country is known for engaging in cybercrimes to generate revenue, primarily to fuel its impoverished economy and support military initiatives, including the development of weapons of mass destruction. The Trojanized packages provide a dual threat: they can be utilized to abscond with cryptocurrency from wallets accessed on compromised machines or to use the computational power of these machines to mine for cryptocurrency.
Amazon also outlined an important evolution in the nature of supply-chain attacks, noting a trend towards increasingly sophisticated tactics. For instance, malicious code is now often split into multiple packages that depend on each other. One package might conceal an encrypted payload, while another could hold the key for decryption. This layered strategy enables hackers to obfuscate their actions better and evade detection.
Even with these emerging threats, experts argue that organizations should not abandon their continuous integration and continuous deployment (CI/CD) practices. Anthony advocated that CI/CD remains the best mechanism for delivering secure, high-quality code. The crucial requirement is to embed secure scanning processes into the CI/CD framework. He cautioned against neglecting security measures, as the swift timeline from vulnerability discovery to exploitation can render any delays in CI/CD processes detrimental. “You now just made yourself more vulnerable for a longer period of time to things that have been found,” Moses warned.
As companies navigate these precarious waters of cybersecurity threats, especially from sophisticated state-sponsored actors, the emphasis on resilience and secure software development practices becomes clearer than ever.