Sapphire Sleet npm packages campaign tied to four compromises, Amazon says
AWS says one North Korea-linked group compromised four npm packages through maintainer accounts, not npm infrastructure or zero-days.
By Dominic Okoye · Staff Writer
· 3 min read
Amazon has tied four compromised npm packages over the past 18 months to Sapphire Sleet, a North Korea-linked crew widely viewed as an offshoot of Lazarus Group. AWS said this week, with medium confidence, that the same operation was behind poisoned releases affecting typo-crypto, chalk, debug and Axios.
The finding matters because the alleged method was not an attack on npm itself. According to AWS, the group targeted the people trusted to publish code: maintainers. The attackers allegedly built relationships, obtained credentials and then shipped malicious updates through normal package release channels that developers already rely on.
AWS said it found shared infrastructure, technical overlap, similar targeting choices and comparable operating patterns across the four incidents. Google had previously attributed the Axios compromise to Sapphire Sleet, which it tracks as UNC1069. Amazon is extending that attribution to all four compromises.
What did AWS say happened to the npm packages?
AWS said the campaign moved from a lesser-known package, typo-crypto, toward packages with far broader use, including chalk, debug and Axios. If that analysis is correct, the incidents show a shift from lower-profile targets to dependencies embedded across large parts of the JavaScript ecosystem.
The company did not say npm’s own infrastructure was breached, and it did not point to zero-day exploitation. It also did not disclose a victim count, the number of downstream environments affected, or financial losses tied to the poisoned packages. The central claim is narrower: trusted maintainer access gave the attackers a route to publish malicious code where developers expected legitimate updates.
That route is attractive because package ecosystems concentrate trust. A compromise of one maintainer account can reach many downstream users faster than targeting each organization separately. AWS described the strategy as partly economic: a small number of package compromises can create a chance to reach thousands of environments through the software supply chain.
How does generative AI change these attacks?
AWS warned that generative AI can make long-running social engineering campaigns cheaper and more convincing. The company said attackers can use it to create believable developer identities, tailor outreach to individual maintainers and sustain conversations long enough to earn trust.
“Attackers can now produce thousands of lines of coherent, idiomatic, well-commented code, complete with convincing documentation, plausible commit histories, and synthetic maintainer identities, wrapped around a backdoor,” said CJ Moses, AWS CISO. “Because each variant can be mutated, renamed, restructured, and re-encrypted, there is no single stable signature to match. Pattern-based detection loses ground against malware that looks one of a kind in every deployment.”
Amazon’s assessment fits prior reporting on Sapphire Sleet’s use of fake jobs, developer-focused social engineering and cryptocurrency theft. AWS argues that the same playbook has been adapted for software supply chain attacks, where reputation and maintainer access can matter as much as exploit code.
The attribution is not settled across the industry. AWS assigned medium confidence, and it remains unclear whether other researchers will agree that all four npm compromises belong to one North Korean operation. For engineering and security teams, the more immediate point is operational: package provenance, maintainer account security and release verification are now part of the threat model for dependencies that once looked routine.
This story draws on original reporting from The Register.
