A series of attacks on npm libraries including axios was the work of North Korean actors, AWS has said.
The cloud computing giant said in a blog post on July 29 that compromises of the axios, debug, chalk and typo-crypto libraries were carried out by the same group, known as Saphire Sleet, BlueNoroff and other monikers.
Amazon Threat Intelligence made the connection after analyzing tactics, techniques, and procedures (TTPs) related to the axios attack.
“Amazon Threat Intelligence identified shared TTPs across these supply-chain campaigns, including trojanized NPM packages, use of post-install hooks (scripts that run automatically when a package is installed), and code reuse,” CJ Moses, CISO and VP of security engineering at Amazon, explained.
“Based on analysis of command-and-control (C2) indicators and TTPs, Amazon Threat Intelligence assesses with medium confidence that these campaigns are attributable to the DPRK-linked threat actor tracked as Saphire Sleet.”
Read more on npm attacks: GitHub to Update npm to Thwart Software Supply Chain Attacks
In each of the attacks, the playbook was the same. The group socially engineered the package maintainer then published a software update containing malicious code, meaning any organization that automatically pulled these versions received a compromised update.
Moses said the typo-crypto compromise in March 2025 was likely a test run for the campaigns that followed, which had a much greater reach. Around 10% of cloud environments were affected by the debug and chalk supply chain attacks in a two-hour window, while axios is one of the most popular JavaScript libraries around, with over 100 million weekly downloads.
“By compromising a small number of highly popular packages, the group gains potential access to thousands of downstream environments simultaneously,” said Moses. “For a financially motivated threat actor, this approach is far more efficient than targeting organizations one at a time.”
AWS Details Shifting Attacker Tradecraft
Moses explained that attacker TTPs are evolving when it comes to targeting open source libraries:
- Attackers are splitting single malicious workflow across several ordinary-looking packages to make detection harder
- Threat actors often play the long game, behaving like “real maintainers” for weeks or months before publishing their malicious updates
- Package contents are often benign: it is the external scripts, configuration files and remote endpoints connected to them that are malicious
- Obfuscation of the malware itself is getting more sophisticated, including “AES‑GCM encrypted blobs gated by passphrases, RC4-style string arrays with per-call keys, layered XOR over base64, and native loaders”
- Payloads are becoming smarter to evade sandbox analysis
- Attackers are using slopsquatting techniques – where they register package names that have been hallucinated by AI coding tools in order to increase victim numbers
Despite AWS's efforts, Cris Thomas, security advocate at Semgrep, argued that attribution is best left to governments and law enforcement.
“Defenders should not concern themselves too much with who is performing an attack and more with knowing likely techniques of a specific attacker. Distinguishing between one group and another can be helpful for defense teams, knowing whether it is North Korea or Canada is less relevant,” he added.
“As always defenders should rely on defense in depth, if one defense doesn't find them another one will. The goal isn't to prevent successful attacks but to identify, limit, block, and correct attacks as soon as possible.”