Amazon links North Korean group to multiple open-source supply chain attacks on NPM libraries

North Korean Group Identified in NPM Compromises

Amazon Threat Intelligence has publicly linked a North Korean-backed threat actor to several recent supply chain compromises affecting widely used Node Package Manager (NPM) libraries. This actor, known by various names including SAPPHIRE SLEET and BlueNoroff, is responsible for attacks on packages such as axios, debug, chalk, and typo-crypto.

The identification of a single state-sponsored group behind these distinct incidents provides new insight into the coordinated nature of these attacks, which exploit the trust placed in open-source components.

Evolving Threat Landscape and AI's Role

The analysis from Amazon also indicates that generative AI is beginning to influence the characteristics of malicious software packages. Threat actors are reportedly exploring AI-based code systems, suggesting a new frontier for supply chain attacks.

This development follows a trend of increasing volume and sophistication in software supply chain attacks, particularly since the XZ Utils backdoor incident two years prior, with DPRK-linked actors being a significant driver.

Impact on Open-Source Ecosystem

Open-source software forms the foundation of much of the internet's infrastructure, including operating systems, web servers, and application frameworks. Compromises of widely used open-source packages can affect any organization that depends on them.

Amazon is sharing this research to assist the open-source community and security teams in better identifying and responding to these types of events, and AWS is detailing its efforts to help customers detect and mitigate these threats.