The axios package alone receives more than 100 million downloads each week — and Amazon researchers say that a North Korea-linked hacking group used that reach to help infect downstream software users, part of a broader campaign tied to open-source compromises dating back to March 2025.
Four compromised JavaScript packages
Amazon Threat Intelligence linked a single financially motivated actor to four compromises of major JavaScript packages: typo-crypto, debug, chalk and axios. The assessment, announced Wednesday, connects the same actor to compromises dating to March 2025 and expands the publicly known scope of Pyongyang-backed efforts to weaponize trusted open-source code. The axios compromise had previously been attributed to the North Korea-linked group; Amazon said its new analysis ties three earlier incidents to the same operation.
Attribution, confidence, and the tracked actor names
Amazon Threat Intelligence attributed the campaigns to a North Korea-linked group with “medium confidence,” according to a blog post authored by Amazon Integrated Security CISO CJ Moses that Amazon scheduled for release Wednesday evening. Researchers track the intruders under multiple labels, including Sapphire Sleet, Stardust Chollima, BlueNoroff, CageyChameleon and Alluring Pisces.
How the attackers gained access — maintainers and malicious updates
In each incident, Amazon said, the hackers tricked a trusted software maintainer and used that access to publish an update that contained malicious code. Organizations configured to automatically download the latest versions of those packages may have pulled the compromised updates directly into their systems. Amazon warned that this approach lets attackers compromise a small number of widely used packages while potentially gaining access to thousands of downstream systems — an efficiency far preferable to targeting companies one by one. “One successful supply chain compromise can yield access to hundreds, if not more, targeted intrusions,” Moses told reporters.
Amazon senior manager Rick Anthony described the human side of the risk, noting that many open-source projects “are often not maintained by people who are getting paid to do that as a full-time job” and that communities are “very welcoming for anyone who is willing to contribute.” That openness, Amazon argued, can be exploited by attackers who spend weeks or months posing as legitimate contributors before attempting to insert malicious code.
Multi-package splitting and AI make malicious behavior harder to detect
Amazon’s write-up also detailed techniques that complicate detection. Attackers are increasingly splitting malicious functionality across multiple packages so individual components appear benign when reviewed alone: one package might contain encrypted data, another the unlock code, and a third the instructions to download and execute a final payload, Amazon said. The malicious behavior becomes visible only when the components are used together.
AI further complicates defenses. Amazon warned that threat actors can use AI to produce polished-looking code, convincing documentation and fake developer profiles, removing obvious mistakes that once triggered alarms. Attackers can also exploit errors made by AI coding assistants: if an AI tool recommends a package that does not exist, an adversary can register that name and populate it with malware, hoping a developer or automated system will install it without noticing the mismatch.
What this means for open-source maintainers, policymakers, and affected enterprises
- Open-source maintainers: The incidents underscore the risk of long-term, relationship-based account compromises. Maintainers who rely on volunteer contribution models will face pressure to strengthen contributor vetting and to adopt stricter code review and publishing controls.
- Policymakers and regulators: Concerns about open-source security have drawn attention in Washington. In December, the chairman of the Senate Intelligence Committee asked the White House national cyber director to take steps to address vulnerabilities in open-source projects used across U.S. military and civilian agencies, reinforcing calls for coordinated policy responses.
- Affected enterprises and procurement leaders: Organizations that allow automated dependency updates are at particular risk of pulling compromised packages directly into production systems. Last August, reporting by Nextgov/FCW highlighted related supply-chain exposure when a Yandex employee was the sole maintainer of a widely used open-source tool embedded in at least 30 pre-built software packages available to the Defense Department.
Amazon’s findings extend the public record of how a North Korea-linked actor leverages trusted open-source code for financial gain and operational access. The work illustrates a convergence of social engineering, supply-chain mechanics and emerging AI-enabled deception that favors small, targeted compromises with outsized returns. The immediate question the report leaves on the table is whether defenders — from maintainers to government cyber leaders — can adapt quickly enough to blunt techniques that intentionally blur the line between legitimate contribution and covert intrusion.
