Back Nknews

North Korean hackers expand open-source software supply chain attacks: Amazon

Nknews • July 30, 2026

Researchers link DPRK group to attacks on four popular JavaScript libraries underpinning software development worldwide

Shreyas Reddy July 30, 2026

North Korean cybercriminals are increasingly moving beyond direct intrusions into targeted networks by compromising open-source software libraries that underpin applications used worldwide, according to new research from Amazon.

In a report published Wednesday, Amazon Threat Intelligence linked the North Korean threat actor Sapphire Sleet to the compromises of the popular software libraries Axios, Debug, Chalk and Typo-crypto. While the Axios attack was previously linked to North Korean actors, this is the first time the other three incidents have been publicly attributed to the group.

The assessment made with “medium confidence” was based on shared technical

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

North Korean Hackers Target Open Source Software Supply Chain via npm Packages Amazon's threat intelligence has linked a series of compromises of popular npm packages—axios, debug, chalk, and typo-crypto—to a North Korean hacking group known as Sapphire Sleet. The group employed social engineering tactics to compromise maintainers' accounts, allowing them to publish malicious updates that affected numerous organizations globally. The axios package, which alone has over 100 million weekly downloads, was targeted in March 2026, following earlier compromises of the other packages in 2025. The attack vector involved injecting malicious dependencies that deployed backdoors across various operating systems. This coordinated campaign highlights a shift from direct intrusions to exploiting open-source software supply chains. Amazon's findings indicate that the threat actor's methods are evolving, aided by generative AI technologies. The scope of impact is significant, with estimates suggesting that 10% of cloud environments were affected by the debug and chalk incidents within hours of their compromise. 9 sources 77

Extracted Entities

North Korean hackers expand open-source software supply chain attacks: Amazon

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

MITRE ATT&CK (1)