“We believe the March 2025 typo-crypto campaign was a rehearsal,” said CJ Moses, Amazon’s chief information security officer.
Amazon’s timeline and attribution
Amazon’s threat intelligence team told reporters at a media roundtable in Arlington, Va., that the same hacking group linked to the recent compromise of the open-source axios library also planted malicious code in a package named typo-crypto in March 2025. The company said it later connected that activity, by tracing domain records tied to the axios attack, to subsequent compromises of two other packages — debug and chalk — in September 2025. Amazon and other researchers track the actor under several names, including UNC1069, Sapphire Sleet and Stardust Chollima.
How the typo-crypto package worked
Amazon described a staged infection in typo-crypto. The malicious file, named core.js, was designed to resemble a legitimate, unrelated package called core-js. The file activated only when it received a specific numeric input, then contacted a server controlled by the attackers to download a second-stage payload. That second stage varied by operating system: Amazon said different code was delivered for Windows, macOS and Linux.
Amazon added that the package combined encoded text with a cipher — a technique Moses said appeared intended to slow analysis, including by AI-based review tools, without relying on heavy encryption. Researchers said the typo-crypto package had relatively few downloads compared with axios, debug or chalk, and concluded it likely served as operational practice before attacking larger targets.
Axios, scale, and the speed of impact
Axios is a widely used JavaScript library: Amazon noted it is downloaded more than 100 million times a week. Moses used that figure to underline the stakes, saying it represents “real organizations putting real code into production systems every single week.” Amazon cited research by Wiz showing that, in the debug and chalk incidents, about one in ten cloud computing environments were affected within a two-hour span — a statistic Moses used to illustrate how quickly exploit impact can spread today.
Attackers’ operational playbook: trust, reputation, and evasion
Across the four cases Amazon described, the attackers did not breach systems by force. Instead, they “built a relationship with a maintainer who already had access to a package,” then used that access to publish an update containing hidden code. “They didn’t break through a window,” Moses said. “They basically earned the trust of an employee to hand them the keys.”
Rick Anthony, senior engineering manager at Amazon Web Services, framed the problem succinctly: attackers face two tasks — getting malicious code into a package that will run inside organizations, and keeping that code hidden from developers and security tools. Anthony said attackers are increasingly cultivating reputations as legitimate contributors over time, “Let me get my package deployed in as many places as possible so that I can spring the trap later.” He also described a technique in which attackers register package names that AI coding tools sometimes generate by suggestion, allowing developers to pull malicious software without making a typing error.
Amazon and other researchers flagged generative AI as a force-multiplier: it lowers the bar for producing convincing code, documentation and contribution histories that look authentic.
Context from prior incidents and other actors
Moses pointed to an earlier case involving xz-utils, where an attacker gained maintainers’ trust and inserted a backdoor, as a precedent for this pattern. Since that incident, other groups have pursued open-source supply chain compromises at scale: Amazon cited one actor known as TeamPCP that injected malicious code into more than 1,000 packages over a four-month span this year.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: Amazon’s findings underscore risks at the package-maintainer layer — attacks can succeed without an obvious exploit if an attacker gains publishing access. Teams will need to monitor dependencies, publisher reputations, and anomalous package behavior that attempts runtime activation on specific inputs.
- Procurement leaders and affected enterprises: The axios compromise — and the rapid spread reported by Wiz in the debug and chalk incidents — shows how quickly a malicious update can reach production. Buyers should expect supply-chain risk to come not only from explicit vulnerabilities but from compromised maintenance channels and reputation-based authorizations.
- Policymakers and regulators: The Amazon account frames these incidents as part of a pattern tied to nation-state actors and to broader changes in attack tooling, including use of AI-assisted content to create authentic-looking contributions. That combination raises questions about standards for software provenance and maintainer verification.
The record Amazon laid out ties a small, little-known npm package into a chain that culminated in a high-impact compromise: a rehearsal in March 2025 followed by larger strikes in September 2025 and the widely felt axios incident. The central tactical lesson — attackers can cultivate trusted access and then deploy evasive, platform-specific payloads — leaves a narrow margin for defenders to detect and respond before widespread consumption. Will maintainers, package registries, and enterprises change how trust is granted and monitored fast enough to blunt the next staged campaign? The answer will depend on concrete steps to harden publishing controls and to spot the subtle activation patterns Amazon described.
