North Korean Hackers Target Open Source Software Supply Chains

• •North Korean hackers are targeting open source software libraries, particularly NPM packages.
• •Generative AI is changing the nature of malicious software packages.
• •The increase in software supply chain attacks is linked to DPRK threat actors.

Amazon Threat Intelligence has linked a North Korean hacker group to recent compromises of popular Node Package Manager (NPM) libraries, marking a significant escalation in software supply chain attacks. This connection has not been publicly reported until now. The analysis highlights how generative AI is influencing the design of malicious software packages and how attackers are probing AI-based code systems. The threat actor exploits the trust and limited time of volunteer maintainers, as demonstrated by the XZ Utils backdoor incident two years ago. Open source software is critical to internet infrastructure, and compromised libraries can affect numerous organizations that rely on them. Amazon has observed an increase in the volume and sophistication of these attacks, primarily driven by DPRK-linked threat actors and cybercriminal groups.