North Korean Hackers Poisoned axios and chalk, Amazon Confirms

Amazon Links DPRK Hackers to Major NPM Supply Chain Campaign

Amazon security researchers have formally attributed a string of open-source supply chain attacks to SapphireSleet, a North Korean state-sponsored threat group tracked under overlapping vendor names including BlueNoroff, UNC1069, and Alluring Pisces. The campaign — cataloged as MAL-2026-3400 in the Open Source Vulnerabilities (OSV) database — compromised multiple NPM packages with tens of millions of weekly downloads, potentially exposing thousands of downstream organizations in a single set of malicious updates.

What Was Compromised

The campaign escalated in sophistication over roughly 18 months, moving from typosquatting to the compromise of legitimate, trusted packages:

The shift from a low-traffic typosquat package to trusted libraries like axios and chalk marks a significant escalation. These are foundational dependencies embedded in the vast majority of Node.js and JavaScript projects globally. Any organization using automatic dependency updates would have silently pulled the malicious versions without any action on their part.

How the Attacks Worked

Rather than creating fake look-alike packages, SapphireSleet attacked the supply chain at the source by social engineering or compromising legitimate package maintainers — then publishing malicious updates through those trusted accounts. Once published, the malicious versions were indistinguishable from legitimate releases in package registries.

The malware embedded in the compromised packages targeted:

• Password theft — extracting locally stored credentials and browser-saved passwords
• Cryptocurrency assets — targeting wallet files, browser extension storage, and crypto application data
• Personal data exfiltration — collecting system information and file system artifacts

Amazon's researchers highlighted that compromising a single widely-used package "gives attackers access to thousands of downstream environments at once" — a force multiplier that makes supply chain attacks highly efficient for state-sponsored actors operating under resource and sanctions constraints.

Why North Korea Runs These Campaigns

SapphireSleet's activity is part of the broader North Korean state cyber program, which has long used cryptocurrency theft as a primary mechanism for sanctions evasion. North Korean-linked groups stole an estimated $2 billion in cryptocurrency in 2025 alone. Supply chain attacks against NPM packages give these groups reach into developer environments where cryptocurrency tooling, API keys, and exchange credentials are commonly present — a direct pipeline to the assets they are trying to steal.

The progression from low-risk typosquatting to compromising packages with 100M+ weekly downloads also reflects growing operational confidence and sophistication. Targeting axios — the ubiquitous HTTP client used in virtually every JavaScript project that makes web requests — represents one of the most significant package compromises in NPM ecosystem history.

Checking Your Exposure

Organizations should verify they were not affected by auditing their dependency lockfiles for the compromised package versions. The OSV database entry MAL-2026-3400 contains version range indicators for the affected releases.

Recommended steps:

1. Audit lockfiles — check package-lock.json or yarn.lock for affected version ranges of axios, chalk, and debug from the compromise windows
2. Rotate credentials — any environment that ran affected package versions should treat all locally stored credentials, API keys, and crypto wallet keys as potentially compromised
3. Enable dependency scanning — integrate OSV scanning or equivalent tooling into CI/CD pipelines to catch compromised packages before they reach production
4. Pin dependencies — consider pinning critical dependency versions with integrity hashes and reviewing update PRs rather than auto-merging
5. Check for MAL-2026-3400 in your OSV scanner output

Broader Implications

This campaign underscores a systemic risk in the open-source ecosystem: the trust model of package registries is fundamentally based on maintainer account integrity, and sophisticated nation-state actors are targeting that trust layer directly. When a package like axios is compromised, the attack surface spans virtually every JavaScript codebase in the world.

Amazon's decision to publicly attribute this campaign and catalog the malware in OSV reflects an industry shift toward more aggressive disclosure of state-sponsored supply chain activity — providing defenders with the attribution context needed to understand the threat model and prioritize response.

References

• The Record — North Korea hackers behind major open-source supply chain attacks, Amazon says
• OSV — MAL-2026-3400
• CISA — North Korean Cyber Activity