Amazon attributes NPM supply chain attacks to North Korea
Amazon Threat Intelligence has publicly attributed a series of recent NPM open-source supply chain compromises to a North Korean threat actor tracked as SAPPHIRE SLEET. The actor is also known as STARDUST CHOLLIMA, BlueNoroff, CageyChameleon, and Alluring Pisces.
The attribution covers compromises of the axios, debug, chalk, and typo-crypto libraries. Amazon assessed the campaign with medium confidence based on command-and-control indicators and TTPs, and this is the first time these specific NPM compromises have been publicly tied to the DPRK-linked actor.
The compromised packages
The campaign compromised four widely used NPM packages: axios, debug, chalk, and typo-crypto. Each was replaced with a malicious payload delivered as a file named core.js, which Amazon identified as the primary malware tool for this round of the campaign.
The packages are staples of the JavaScript and Node.js ecosystem, with axios and debug among the most downloaded libraries on npm. The compromise pattern matches how SAPPHIRE SLEET has previously injected backdoors into popular open-source repositories, but the use of core.js as the single-file payload is a step up from the actor’s earlier multi-file implants.
Generative AI in the malicious packages
Amazon’s analysis of the axios, debug, chalk, and typo-crypto compromises reveals a new technique in the actor’s implant: a single-file payload named core.js that replaces the earlier multi-file structure. The file is injected directly into the package source, giving the actor a compact, self-contained stage for the initial foothold.
The shift to core.js is notable because it consolidates the implant into one file, reducing the surface area the victim sees and simplifying the actor’s deployment. Amazon notes the technique is evolving, moving the compromise from a multi-file implant to a single-file payload that is easier to drop and harder to spot in the package diff.
Attribution basis and confidence
Amazon Threat Intelligence based its attribution on analysis of the command-and-control indicators and TTPs observed in the compromised packages. The C2 infrastructure and behavioral patterns matched the actor’s known profile, leading Amazon to assign a medium confidence rating to the campaign.
The campaign is attributable to the DPRK-linked threat actor tracked as SAPPHIRE SLEET, which the security community also knows as STARDUST CHOLLIMA, BlueNoroff, CageyChameleon, and Alluring Pisces. This is the first time the specific NPM compromises have been publicly tied to the actor, with the axios, debug, chalk, and typo-crypto packages representing the current round of the campaign.
Key points
- Amazon Threat Intelligence attributes the NPM supply chain compromises to the DPRK actor tracked as SAPPHIRE SLET (also known as STARDUST CHOLLIMA, BlueNoroff, CageyChameleon, Alluring Pisces).
- Compromised packages include axios, debug, chalk, and typo-crypto.
- Attribution is based on C2 indicators and TTPs with medium confidence.
- This is the first public attribution of these NPM compromises to the DPRK actor.
- New findings show generative AI used in the malicious packages.