[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgVmpLpPpMtOSH4ulzruMKHLobvS-1ZBL-DekI5BmmJQ":3,"$fOIj6mAG--MVyvVYjwKJw5uJJFP4JK4KfuMq-fMw42yU":52},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":49,"created_at":50,"updated_at":51,"published_at":33},"amazon-threat-intelligence-attributes-npm-supply-chain-compromises-to-north-kore","Amazon Threat Intelligence attributes NPM supply chain compromises to North Korea's Sapphire Sleet","DPRK actor behind axios, debug, chalk, and typo-crypto compromises, with new generative AI in malicious packages.","Amazon Threat Intelligence publicly attributes recent NPM open-source supply chain compromises to the North Korean threat actor tracked as Sapphire Sleet, based on C2 indicators and TTPs with medium confidence.",[10,11,12,13,14],"SAPPHIRE SLEET","NPM","supply chain","North Korea","DPRK","# Amazon Threat Intelligence attributes NPM supply chain compromises to North Korea's Sapphire Sleet\n\n*DPRK actor behind axios, debug, chalk, and typo-crypto compromises, with new generative AI in malicious packages.*\n\n**Tags:** `SAPPHIRE SLEET` `NPM` `supply chain` `North Korea` `DPRK`\n\n> Amazon Threat Intelligence publicly attributes recent NPM open-source supply chain compromises to the North Korean threat actor tracked as Sapphire Sleet, based on C2 indicators and TTPs with medium confidence.\n\n---\n\n## Amazon attributes NPM supply chain attacks to North Korea\n\nAmazon Threat Intelligence has publicly attributed a series of recent NPM open-source supply chain compromises to a North Korean threat actor tracked as SAPPHIRE SLEET. The actor is also known as STARDUST CHOLLIMA, BlueNoroff, CageyChameleon, and Alluring Pisces.\n\nThe attribution covers compromises of the axios, debug, chalk, and typo-crypto libraries. Amazon assessed the campaign with medium confidence based on command-and-control indicators and TTPs, and this is the first time these specific NPM compromises have been publicly tied to the DPRK-linked actor.\n\n## The compromised packages\n\nThe campaign compromised four widely used NPM packages: axios, debug, chalk, and typo-crypto. Each was replaced with a malicious payload delivered as a file named core.js, which Amazon identified as the primary malware tool for this round of the campaign.\n\nThe packages are staples of the JavaScript and Node.js ecosystem, with axios and debug among the most downloaded libraries on npm. The compromise pattern matches how SAPPHIRE SLEET has previously injected backdoors into popular open-source repositories, but the use of core.js as the single-file payload is a step up from the actor’s earlier multi-file implants.\n\n## Generative AI in the malicious packages\n\nAmazon’s analysis of the axios, debug, chalk, and typo-crypto compromises reveals a new technique in the actor’s implant: a single-file payload named core.js that replaces the earlier multi-file structure. The file is injected directly into the package source, giving the actor a compact, self-contained stage for the initial foothold.\n\nThe shift to core.js is notable because it consolidates the implant into one file, reducing the surface area the victim sees and simplifying the actor’s deployment. Amazon notes the technique is evolving, moving the compromise from a multi-file implant to a single-file payload that is easier to drop and harder to spot in the package diff.\n\n## Attribution basis and confidence\n\nAmazon Threat Intelligence based its attribution on analysis of the command-and-control indicators and TTPs observed in the compromised packages. The C2 infrastructure and behavioral patterns matched the actor’s known profile, leading Amazon to assign a medium confidence rating to the campaign.\n\nThe campaign is attributable to the DPRK-linked threat actor tracked as SAPPHIRE SLEET, which the security community also knows as STARDUST CHOLLIMA, BlueNoroff, CageyChameleon, and Alluring Pisces. This is the first time the specific NPM compromises have been publicly tied to the actor, with the axios, debug, chalk, and typo-crypto packages representing the current round of the campaign.\n\n## Key points\n\n- Amazon Threat Intelligence attributes the NPM supply chain compromises to the DPRK actor tracked as SAPPHIRE SLET (also known as STARDUST CHOLLIMA, BlueNoroff, CageyChameleon, Alluring Pisces).\n- Compromised packages include axios, debug, chalk, and typo-crypto.\n- Attribution is based on C2 indicators and TTPs with medium confidence.\n- This is the first public attribution of these NPM compromises to the DPRK actor.\n- New findings show generative AI used in the malicious packages.\n\n## Further reading & sources\n\n- [Amazon identifies North Korean hacker group behind open-source supply chain attacks | AWS Security Blog](https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fsecurity\u002Famazon-identifies-north-korean-hacker-group-behind-open-source-supply-chain-attacks) — AWS Security\n- [North Korean social engineering campaign targets MacOS users | Computer Weekly](https:\u002F\u002Fwww.computerweekly.com\u002Fnews\u002F366641953\u002FNorth-Korean-social-engineering-campaign-targets-macOS-users)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Famazon-threat-intelligence-attributes-npm-supply-chain-compromises-to-north-kore.png?v=46de02f011",{"actors":18,"malware":25,"targets":28,"timeline":34,"technologies":42},[19],{"url":20,"name":21,"slug":22,"type":23,"origin":13,"motivation":24},"\u002Fthreat-groups\u002Falluring-pisces","Alluring Pisces","alluring-pisces","apt","financial",[26],{"name":27},"core.js",[29],{"name":30,"sector":31,"status":32,"geography":33},"axios","Software Library","confirmed",null,[35,39],{"date":36,"event":37,"description":38},"2025-09","Compromise","Same threat actor compromised debug and chalk NPM packages",{"date":40,"event":37,"description":41},"2026-03","Same operational playbook compromised axios package",[43,45,46],{"vendor":11,"product":44},"debug",{"vendor":11,"product":30},{"vendor":47,"product":48},"Apple","macOS","supply_chain","2026-09-17T07:13:22.758316+00:00","2026-10-16T12:28:35.944207+00:00",{"articles":53},[54,66,80,93],{"slug":55,"title":56,"summary":57,"tags":58,"hero_image_url":64,"story_type":49,"created_at":65},"palo-alto-unit-42-breaks-down-chaindrop-self-propagating-npm-worm-infects-400-pa","Palo Alto Unit 42 Breaks Down ChainDrop: Self-Propagating npm Worm Infects 400+ Packages","Palo Alto Networks Unit 42 published a research report on the ChainDrop npm worm, a self-propagating supply-chain attack that compromised 400+ packages including keyv and cacheable-request by trojanizing the maintainer's monorepo and using stolen credentials to backdoor all co-owned packages.",[59,60,61,62,63],"ChainDrop","npm","supply-chain","Shai-Hulud","Ethereum C2","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpalo-alto-unit-42-breaks-down-chaindrop-self-propagating-npm-worm-infects-400-pa.png?v=49478b78c8","2026-09-26T12:08:48.531258+00:00",{"slug":67,"title":68,"summary":69,"tags":70,"hero_image_url":77,"story_type":78,"created_at":79},"red-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-","Red Hat Keycloak Critical Flaw Lets Unauthenticated Attackers Reset Any Account Password","Red Hat disclosed a critical vulnerability in Keycloak's reset-credentials flow that allows a remote unauthenticated attacker to bypass the email verification step and reset the password for any user account in any realm.",[71,72,73,74,75,76],"Keycloak","Red Hat","CVE-2026-18963","CVSS 9.1","account takeover","password reset","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fred-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-.png?v=94dc54a17a","vulnerability_disclosure","2026-09-30T12:09:12.456253+00:00",{"slug":81,"title":82,"summary":83,"tags":84,"hero_image_url":91,"story_type":78,"created_at":92},"trend-micro-zdi-windows-shell-link-zero-day-exploited-by-11-state-backed-groups-","Trend Micro ZDI: Windows Shell Link zero-day exploited by 11 state-backed groups since 2017","Trend Micro's Zero-Day Initiative disclosed a new Windows Shell Link (.lnk) zero-day (ZDI-CAN-25373) exploited in the wild by 11 state-backed groups since 2017, which Microsoft declined to patch as 'not meeting the bar servicing'.",[85,86,87,88,89,90],"windows","shell-link","zero-day","ZDI","Trend Micro","state-sponsored","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ftrend-micro-zdi-windows-shell-link-zero-day-exploited-by-11-state-backed-groups-.png?v=a2818b0e7b","2026-09-30T12:04:13.324344+00:00",{"slug":94,"title":95,"summary":96,"tags":97,"hero_image_url":103,"story_type":104,"created_at":105},"sophos-x-ops-34-confirmed-cases-of-attackers-faking-claude-chatgpt-and-copilot-t","Sophos X-Ops: 34 Confirmed Cases of Attackers Faking Claude, ChatGPT, and Copilot to Drop Malware","Sophos X-Ops analyzed 34 confirmed incidents where attackers spoofed Claude, ChatGPT, and Copilot interfaces to deliver malware through malvertising and infostealer payloads.",[98,99,100,101,102],"The Gentlemen","Sophos X-Ops","AI brand impersonation","malvertising","infostealer","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsophos-x-ops-34-confirmed-cases-of-attackers-faking-claude-chatgpt-and-copilot-t.png?v=7a1343b754","campaign","2026-09-30T07:09:51.117027+00:00"]