North Korea's 'Sapphire Sleet' Linked to Widespread JavaScript Supply-Chain Attacks
Amazon Web Services attributes a series of sophisticated supply-chain attacks targeting popular JavaScript libraries on the npm registry to North Korea's 'Sapphire Sleet' threat actor.
Amazon Web Services (AWS) has identified a financially motivated North Korean nation-state threat actor, known as 'Sapphire Sleet' or 'Stardust Chollima,' as the likely perpetrator behind a series of supply-chain attacks targeting open-source JavaScript libraries hosted on the npm registry. The analysis, set for publication, links these attacks with high confidence to the Pyongyang regime, suggesting a coordinated and industrial-scale operation.
The compromised libraries include Axios, Debug, Chalk, and Typo-Crypto. According to CJ Moses, vice president of Amazon engineering, the same threat actor was observed behind all four incidents, utilizing identical Trojanized npm packages, reusing code, and employing consistent tactics, techniques, and procedures (TTPs). These TTPs include the use of automatic scripts that execute upon package installation, a common method for delivering malicious payloads.
Researchers at AWS detailed how the attackers gained the trust of maintainers for these open-source projects by offering genuine support, fixing bugs, responding to pull requests, and contributing to documentation. This approach allowed them to blend in as legitimate community members, a tactic that exploits the open-source ecosystem's reliance on collaboration and trust. Rick Anthony, a senior engineering leader at AWS, noted that the npm repository is a prime target due to its ubiquity in web development and its potential to interact with sensitive areas like Web3 protocols and cryptocurrency wallets.
The attack on the Typo-Crypto package in March 2025 is believed to have served as a test run for more ambitious operations, such as the later compromise of Axios, one of the most downloaded JavaScript libraries. This smaller-scale compromise allowed the threat actor to refine their TTPs before targeting a high-profile project with millions of weekly downloads.
North Korea is known for its state-sponsored hacking operations, often aimed at generating hard currency to fund its impoverished economy and military programs. The compromised packages are designed to steal cryptocurrency directly from user wallets or leverage infected machines for cryptocurrency mining. AWS observed that these attacks are becoming increasingly sophisticated, with malicious code often split across multiple interdependent packages, sometimes using encrypted blobs disguised as configuration files.
To evade detection, the attackers employ advanced techniques, such as ensuring their code does not run in sandboxed environments and embedding commands designed to fool artificial intelligence analysis tools into believing the code has already been reviewed and deemed clean. These methods highlight the evolving nature of supply-chain threats and the need for robust security measures throughout the software development lifecycle.
Despite the increasing sophistication of these attacks, AWS emphasized that enterprises should not abandon continuous integration and continuous deployment (CI/CD) practices. Instead, the focus should shift towards securing CI/CD pipelines with integrated scanning and rigorous security checks. Moses argued that slowing down CI/CD processes can paradoxically increase vulnerability by delaying the patching of known exploits.
The findings underscore the persistent threat posed by nation-state actors to the open-source software ecosystem. The ability of groups like Sapphire Sleet to infiltrate trusted repositories and compromise widely used libraries presents a significant risk to downstream users, necessitating enhanced vigilance and security practices from developers and organizations alike.
Amazon researchers have uncovered evidence that the North Korean-backed group, also known as UNC1069 or Sapphire Sleet, used the typo-crypto npm package compromise in March 2025 as a deliberate 'rehearsal' for its later, more high-profile attack on the axios library. This earlier campaign, along with separate compromises of the debug and chalk packages in September 2025, allowed the group to refine its social engineering tactics of gaining trust with package maintainers to publish malicious updates, testing its methods on less scrutinized targets before escalating to widely used software.