Amazon Threat Intelligence has linked a series of major NPM supply-chain compromises to a Democratic People’s Republic of Korea (DPRK)-linked threat actor.
The campaigns targeted trusted open-source JavaScript libraries and delivered malware capable of infecting Windows, macOS, and Linux systems.
The actor, tracked as SAPPHIRE SLEET, STARDUST CHOLLIMA, BlueNoroff, CageyChameleon, and Alluring Pisces, allegedly compromised the popular axios, debug, chalk, and typo-crypto packages.
The activity highlights how attackers can weaponize a single trusted dependency to reach thousands of downstream developers, build servers, and production environments.
Amazon assesses with medium confidence that the same financially motivated DPRK-linked group conducted the campaigns.
The attackers reportedly used social engineering to gain access to trusted package maintainers, then published malicious updates that appeared legitimate.
Organizations that automatically installed the latest package releases could unknowingly receive the trojanized versions. This approach turns a routine dependency update into an initial-access vector.
Trojanized npm Drops Cross-Platform RAT
The earliest identified activity involved the typo-crypto NPM package in March 2025. Investigators discovered a malicious file named core.js, designed to resemble the legitimate core-js package.
The code activated only when it received a hash value beginning with 0098273. Once triggered, it contacted a hardcoded command-and-control server, downloaded a second-stage payload, and executed operating-system-specific malware.
The payload behavior was tailored for Windows, macOS, and Linux. It also used file-based persistence, allowing malicious code to remain active after system restarts or later executions.
Amazon said the malware used multiple obfuscation layers, including Base64 encoding and XOR encryption keyed with 01042025.
This technique makes basic static inspection more difficult because the malicious logic is hidden until runtime.
Associated indicators include the domain npmjs[.]store and IP address 216[.]74[.]123[.]126. The trojanized typo-crypto package and core.js file have been documented in the Open Source Vulnerabilities database as MAL-2026-3400.
The typo-crypto activity had limited downloads and may have served as an early test campaign.
However, its code patterns, infrastructure indicators, and delivery methods reportedly overlap with later compromises involving far more widely used packages.
The March 2026 axios incident was especially significant because axios receives more than 100 million weekly downloads.
A successful compromise of a package at that scale can rapidly expose developer workstations, CI/CD pipelines, cloud workloads, and enterprise applications.
Recent NPM attacks are moving beyond simple malicious install scripts. Threat actors are increasingly dividing harmful functionality across several harmless-looking packages.
One package may contain encrypted data, another may include decryption logic, and a third may download or execute the final payload.
This fragment-level design can evade package-by-package scanning because no single dependency appears clearly malicious.
Security teams must instead examine the full dependency graph, package interactions, lifecycle scripts, external network calls, and unusual runtime behavior, amazon said.
Attackers are also investing time in trust. They may publish useful packages, fix bugs, build a contributor history, and gain user confidence before introducing malicious code.
This mirrors the long-term social engineering approach seen in the XZ Utils backdoor incident.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
-linked){kind=link}