Amazon ties four poisoned npm packages to a single North Korean crew

Amazon's security team just tied four poisoned npm packages to a single North Korean crew, in a public attribution that points to the software supply chain's weak point. The attackers did not break into npm. They phished the humans who already had publish rights.

The four packages are typo-crypto, chalk, debug, and Axios, the JavaScript HTTP client. All four were hijacked over roughly 18 months, according to Amazon's research, and all four trace back to one North Korea-linked operator that Amazon tracks as Sapphire Sleet. Google and Mandiant, working from the earlier Axios compromise, call the same group UNC1069 and treat it as a Lazarus offshoot (Amazon attributes four npm hijacks to one North Korea-linked crew, The Register; Amazon links debug and chalk npm hijack, The Hacker News).

For a reader who does not live in JavaScript, npm is the de facto package-sharing hub for the language: tens of millions of developers pull libraries from it the way a contractor pulls parts from a hardware store. A supply-chain attack in this context means a compromise that reaches victims not through their own networks or devices but through shared code. The poisoned package becomes a stowaway inside every project that downloads it.

The four packages share a method. There was no zero-day in npm, no breach of the registry's infrastructure, and no mass credential dump. The attackers social-engineered individual maintainers, captured their publish credentials, and pushed malicious updates from accounts that downstream projects already trusted. The hijack lived inside a normal-looking release, signed by a familiar name, on a normal release schedule.

The lock on the registry's front door holds. The vulnerability is the person holding the publishing key and the workflow that lets one maintainer push code to millions of installs without a second pair of eyes. The Register's writeup notes the activity spans about 18 months, a window long enough to suggest the crew rotated through targets rather than running a single smash-and-grab.

Two large platforms pointing at the same name at medium confidence carries more weight than either would alone, and it gives defenders a sharper filter for hunting the group's infrastructure across other ecosystems. The convergence closes a loop that started with Google's earlier UNC1069 labeling on the Axios compromise and extends the same conclusion to chalk and debug.

The confidence level matters. Amazon describes the attribution as medium, not high, and the UNC1069↔Sapphire Sleet mapping is a convention, not a formal cross-vendor confirmation. The piece does not name a single human at the keyboard. It names a coordinated operator whose playbook involves phishing a maintainer, taking the credential, pushing an update, and harvesting what flows downstream.

The pattern generalizes beyond JavaScript. PyPI for Python, RubyGems, the Cargo registry for Rust, and the Go module proxy all run on the same trust model: a small number of human maintainers, a large number of transitive consumers, and a publishing path that defaults to fast and frictionless. None of those registries were named in Amazon's research, but the same attack works on each of them in principle, and the defender's lesson is the same: lock down the publisher, not just the package.

With the attribution in hand, registries have an opening to harden in the obvious places: mandatory two-factor for high-leverage maintainers, signed releases, faster revocation when a poisoned update lands. npm is a trust hub, and the next attempt is unlikely to be the last.