A new attribution for a familiar threat
North Korean hackers are behind a string of high-profile compromises of open-source software libraries, according to a new report from Amazon researchers. The company says the threat actor known as SapphireSleet hit four separate JavaScript packages hosted on the Node Package Manager (NPM) repository.
The findings, released Wednesday, link the group to incidents that had previously only been partially attributed. Security researchers had already tied the axios compromise to North Korea, but Amazon says the earlier attacks on other packages were not publicly connected to the same operation.
Four packages, one campaign
Amazon’s timeline shows a methodical campaign stretching over a year. The attackers first compromised the typo-crypto package in March 2025. By September of that year, they had moved on to the popular debug and chalk packages. Then, in March 2026, the same operation appeared to compromise axios.
That last one is significant. Axios is one of the most widely used JavaScript libraries in the world, downloaded more than 100 million times each week. It’s embedded in countless web applications and enterprise services. A malicious update to a package like that can ripple outward fast.
How the attacks worked
In each case, Amazon says the hackers gained access by socially engineering a trusted maintainer of the software package. Once inside, they published a malicious update. Organizations that automatically installed the latest versions unknowingly downloaded malware.
This is a key detail. SapphireSleet doesn’t rely on software vulnerabilities. It relies on people. The group’s attacks are designed to steal passwords, cryptocurrency assets, and personal data.
Who is SapphireSleet?
Earlier in March, Google attributed the axios attack to a North Korean threat actor it tracks as UNC1069. Microsoft linked the same compromise to Sapphire Sleet, which it says overlaps with activity that other vendors track as UNC1069, BlueNoroff, Stardust Chollima, CageyChameleon, and Alluring Pisces.
Amazon’s report essentially confirms that all four package compromises were the work of the same group. That’s a broader footprint than previously understood.
Why open-source repositories are targets
Open-source software repositories have become increasingly attractive targets for financially motivated hackers, Amazon said. The logic is simple: rather than breaking into organizations individually, attackers can compromise a handful of widely used software packages and potentially gain access to thousands of downstream environments at once.
“When an attacker compromises a widely used open source package, every organization that depends on that package is potentially affected,” Amazon researchers said.
The scale of the problem is hard to overstate. A single malicious update to a popular package can reach millions of developers and countless production systems before anyone notices.
North Korea’s cyber theft economy
The motivation here isn’t espionage. It’s revenue. North Korea has increasingly relied on crypto and cyber theft to generate money in the face of international sanctions. The country stole more than $2 billion worth of cryptocurrency in 2025, its largest annual haul on record, according to previous reports.
That kind of money funds weapons programs and keeps the regime afloat. It also makes North Korean hackers among the most persistent and well-resourced threat actors in the world.
What this means for developers
Amazon reported the malware used in the campaign to the Open Source Vulnerabilities database, where it is tracked as MAL-2026-3400. That’s useful for defenders, but the broader lesson is about trust.
Open-source packages are maintained by volunteers, often with limited resources. A determined adversary can target those maintainers with phishing, credential theft, or other social engineering tactics. The result is that even the most reputable packages can be compromised.
For organizations, the takeaway is to audit your dependencies. Know what you’re installing and where it comes from. Consider pinning versions rather than automatically pulling the latest release. And treat open-source code with the same scrutiny you’d apply to any third-party software.
This is a reminder that supply chain security isn’t just about vendors and hardware. It’s about the code you build on. The next time you run npm install, think about who wrote that package — and who might have gotten to them first.
