North Korean-linked hackers are turning trusted npm packages into an entry point for widespread software supply-chain attacks.
By compromising the accounts of legitimate package maintainers, the attackers can slip malicious updates into tools that developers and businesses already trust.
The campaigns affected the typo-crypto, debug, chalk, and axios packages at different points between March 2025 and March 2026.
Organizations that automatically installed the newest versions could unknowingly pull in the malicious code during routine development or build activity.
Analysts at AWS identified the campaigns as the work of a DPRK-linked actor tracked as SAPPHIRE SLEET, STARDUST CHOLLIMA, BlueNoroff, CageyChameleon, and Alluring Pisces.
AWS said in a report shared with Cyber Security News (CSN) that the group used shared techniques, malicious npm packages, and reused code across the incidents.
The impact is significant because open-source dependencies sit inside countless applications, cloud workloads, and automated build systems.
A single poisoned update can create access to many downstream environments at once, echoing the risks seen in other npm package supply-chain compromises that spread through trusted development tools.
North Korean Hackers Turn Trusted npm Packages
The attackers reportedly relied on social engineering to gain control of trusted maintainer accounts.
Once inside, they published updates containing hidden code, using the credibility of established packages to bypass the caution normally applied to unfamiliar dependencies.
Axios was the largest known target, with more than 100 million weekly downloads when it was compromised in March 2026.
AWS assessed that the same operational approach had previously been used against typo-crypto, debug, and chalk, linking incidents that had not been publicly connected before.
The debug and chalk event demonstrated how quickly the damage can spread. Research cited by AWS found that roughly one in 10 cloud environments was affected within a two-hour period, underlining why software supply-chain security risks can move faster than many incident-response plans.
In the typo-crypto campaign, the attackers added a file named core.js that posed as the legitimate core-js package.
The file ran only when it received a hash input beginning with 0098273, then downloaded and executed a second-stage payload suited to Windows, macOS, or Linux systems.
AWS assessed that this smaller March 2025 operation was likely a testing ground for later attacks.
It showed the group refining its methods before targeting more visible and heavily used packages, while keeping the number of observed downloads relatively low.
The malware used persistence through files, rotated its payloads, and hid its activity with layered encoding and encryption.
The approach gave attackers a way to avoid easy detection while retaining the ability to change what compromised systems downloaded later.
Attack Methods Keep Evolving
AWS warned that attackers are increasingly splitting harmful activity across several ordinary-looking packages.
One package may store encrypted data, another may contain the code to unlock it, and a third may retrieve the final payload, making isolated reviews less effective.
Threat actors are also building trust over time by maintaining useful projects or becoming contributors before abusing that position.
That patient approach resembles the pattern behind the XZ Utils incident and recent North Korean npm package attacks, where legitimate access became the attackers’ most valuable asset.
Another concern is the separation of a package from its real behavior. A package can appear harmless in the public registry but call external scripts, configuration files, or remote servers at runtime, allowing attackers to activate malicious behavior without publishing a new version.
Generative AI is adding another layer of risk. AWS noted that attackers can use AI to create convincing documentation, maintainers, and code, while “slopsquatting” may exploit package names incorrectly suggested by coding assistants and then installed by developers.
Security teams should maintain a clear inventory of dependencies, inspect unexpected package changes, and review how packages behave during installation and runtime.
Teams should also limit automatic updates where practical and investigate unusual network connections from build systems or developer workstations.
Organizations should treat a suspected dependency compromise as a broader credential and environment risk.
Reviewing affected repositories, isolating exposed systems, rotating credentials where needed, and monitoring for follow-on activity can reduce the chance that a package compromise becomes a larger breach, as seen in credential-stealing npm attacks.
Indicators of compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| Domain | npmjs.store | Command-and-control domain associated with the typo-crypto campaign |
| IP Address | 216.74.123.126 | Command-and-control server IP address |
| npm Package | typo-crypto | Package compromised with a trojanized file in March 2025 |
| SHA-256 | 24604384b0e748ada07923630b3d037489e696284a98c4409fb9b6763565571f | SHA-256 hash for the compromised typo-crypto package |
| File Name | core.js | Trojanized file masquerading as the legitimate core-js package |
| SHA-256 | 2014d09c7ded74d89c885b5f11693865224116f1b25df9330e61fe528f419d73 | SHA-256 hash for the malicious core.js file |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
