North Korean Hackers Target Open Source Software Libraries

Amazon's threat intelligence team has linked a North Korean hacker group to multiple compromises of popular open source software libraries, including axios, debug, chalk, and typo-crypto. The group, tracked under various names, exploited social engineering tactics to gain access to trusted maintainers, allowing them to publish malicious updates. The axios library, which has over 100 million weekly downloads, was compromised in March 2026, following earlier attacks on smaller packages like typo-crypto in March 2025. The malicious code in typo-crypto was designed to evade detection by AI-based tools. This incident highlights the increasing sophistication and volume of software supply chain attacks attributed to DPRK-linked actors. Organizations relying on these libraries are at risk, as the compromised packages could affect countless applications globally.

Key Points: • North Korean hackers compromised multiple open source libraries, including axios and typo-crypto. • The attack method involved social engineering trusted maintainers to publish malicious updates. • The axios library alone is downloaded over 100 million times weekly, amplifying the potential impact.