Amazon Links North Korean Hackers to Compromises of Axios and Other Popular JavaScript Libraries

Amazon has identified a North Korea-linked group as responsible for compromising widely used open-source JavaScript packages, including the heavily downloaded axios library, through social engineering attacks on maintainers.

Key Points:

• Amazon attributes four compromises of popular NPM packages, including axios, debug, and chalk, to the North Korea-linked threat actor SapphireSleet.
• The attackers gained access by socially engineering trusted software maintainers to publish malicious updates rather than exploiting software vulnerabilities.
• The axios library, downloaded over 100 million times weekly, was compromised in March 2026, potentially affecting countless web applications and enterprise services.
• Other major tech firms, including Google and Microsoft, have linked these activities to North Korean groups such as UNC1069 and BlueNoroff.
• The campaign highlights the growing risk to open-source supply chains, where compromising a single package can impact thousands of downstream organizations.

Amazon researchers have revealed that a North Korea-linked hacker group, identified as SapphireSleet, successfully compromised several high-profile JavaScript packages hosted on the Node Package Manager (NPM). The attacks targeted the typo-crypto package in March 2025, followed by the debug and chalk packages in September 2025. Most significantly, the group compromised the axios library in March 2026. Axios is one of the most widely used JavaScript libraries globally, with over 100 million weekly downloads, meaning the compromise potentially exposed a vast number of web applications and enterprise services to malware.

The group did not rely on technical exploits to breach these systems. Instead, they used social engineering to gain the trust of trusted maintainers, who then published malicious updates. Organizations that automatically install the latest versions of these packages unknowingly downloaded the malware. This method allows attackers to bypass traditional security defenses by leveraging the trust inherent in open-source development communities. The malware is designed to steal passwords, cryptocurrency assets, and personal data, aligning with North Korea's strategy to generate revenue through cyber theft amid international sanctions.

This incident underscores the increasing attractiveness of open-source software repositories for financially motivated hackers. By compromising a handful of widely used packages, attackers can gain access to thousands of downstream environments simultaneously. Amazon has reported the malware to the Open Source Vulnerabilities database, and the incident has been corroborated by other security firms, including Google and Microsoft, which have linked similar activities to North Korean threat actors. The event serves as a stark reminder of the vulnerabilities within the software supply chain and the importance of verifying package integrity.

Learn More: The Record

Want to stay updated on the latest cyber threats?

👉 [Subscribe to r/PwnHub](https://www.reddit.com/r/pwnhub)