If you work with JavaScript, there’s a good chance you’ve used a package from the Node Package Manager (NPM) without thinking twice. That trust is exactly what a North Korean state-sponsored group has been exploiting.
Amazon attributed four separate NPM compromises to SapphireSleet, including the package typo-crypto in March 2025, followed by debug and chalk in September 2025, and finally axios in March 2026. Axios is one of the most popular JavaScript libraries on the planet, downloaded more than 100 million times every week. The attackers designed these malicious packages to steal passwords, cryptocurrency, and personal data, contributing to North Korea‘s record-breaking haul of over $2 billion in crypto theft during 2025. This NPM malware campaign is a stark reminder that state-sponsored open source threats are becoming increasingly brazen, targeting the software supply chain at its most vulnerable point: the packages you rely on every day.
Compromised Packages and Timeline of the Attacks
The full scope of this North Korean supply chain threat becomes clear when you look at the timeline of compromises attributed to the group behind the campaign. Amazon has linked four separate incidents to the same threat actor, known as SapphireSleet, spanning over a year of activity. The earlier compromises had not previously been publicly connected, making this attribution a significant development in understanding how widespread the operation really was.
Typo-crypto, Debug, Chalk, and Axios: A Year of Infiltration
The first known compromise was typo-crypto in March 2025, a malicious npm package designed to catch developers who mistyped cryptocurrency-related library names. This was followed by two simultaneous compromises in September 2025: debug and chalk, both popular utility packages used in countless Node.js projects. The most recent and potentially most damaging compromise was axios in March 2026, a widely used HTTP library that many web applications depend on for making network requests.
What makes this timeline especially concerning is that the earlier compromises — typo-crypto, debug, and chalk — had not been publicly linked to the same North Korean threat actor until Amazon’s investigation connected the dots. This means the attackers were able to operate undetected as a coordinated campaign for over a year, targeting both utility packages and a core networking library to maximize their reach across the npm supply chain. For anyone maintaining open source dependencies, this axios compromise timeline highlights the importance of scrutinizing not just the packages you directly install, but also the entire chain of dependencies they bring in. The attackers strategically chose packages that would give them broad access to the software supply chain, turning everyday development tools into potential vectors for infiltration.
Social Engineering Tactics and Attacker Objectives
But the most striking part of this operation wasn’t the code itself. Rather than exploiting software flaws, SapphireSleet relied on manipulating a trusted maintainer to gain access to the packages. That is a key detail for anyone trying to understand how a North Korean supply chain attack like this actually works. It means the defense that normally protects open source software — the vigilance of its maintainers — was precisely the target.
How a Trusted Maintainer Was Targeted
The attackers gained access by socially engineering a trusted maintainer of the software package before publishing a malicious update. Specific details on the social engineering pretext and the communication method are still emerging, but the attack vector was purely human-based. No zero-day exploit, no clever injection at the code level — just a carefully crafted deception designed to win a developer’s confidence.
This kind of developer account compromise is deeply worrying because trust flows downstream. Once a legitimate maintainer has been misled, every user who updates the package is exposed. You could follow every recommended security step and still be caught out, simply because someone further up the chain let their guard down.
So what motivates the group? The malicious updates weren’t designed to crash systems or cause visible damage. Instead, the attacks are built to steal passwords, cryptocurrency assets and personal data from unsuspecting users. For anyone holding crypto or reusing passwords across accounts, this North Korean supply chain campaign is a reminder that threats don’t always look like technical exploits. Sometimes they look like a routine update from a developer you already trust.
Impact, Detection, and Downstream Exposure
That routine update you trust? In this campaign, it became the delivery mechanism. Organizations that automatically installed the latest versions of compromised packages unknowingly downloaded malware, turning their own systems into distribution nodes. This is the reality of a modern supply chain attack: one malicious commit can ripple outward to thousands of downstream users.
The Role of Automated Updates in Spreading Malware
Automated dependency updates, while convenient for keeping software current, are also a primary vector for malware distribution via npm. When a package like axios—downloaded more than 100 million times each week—is compromised, any system configured to auto-update instantly pulls in the malicious code. This means that even if you don’t directly use the infected package, you might be affected if a dependency in your project relies on it. The reach is staggering, and the full number of affected downstream users is still being assessed.
Detection is another challenge. The time window between compromise and detection for each package is a known gap that security researchers are investigating. Some packages remained compromised for weeks, giving attackers ample opportunity to propagate their malware. This delay highlights the difficulty of identifying supply chain attacks, where the malicious code blends into routine updates.
For a North Korean supply chain attack of this scale, the downstream exposure is vast. Every organization that used the compromised packages becomes a potential victim, and tracing the full impact requires extensive analysis. This incident underscores the need for proactive measures, such as verifying package integrity and monitoring for unusual behavior, rather than relying solely on automatic updates.
Attribution and Tracking by Security Researchers
From UNC1069 to SapphireSleet: Unifying the Threat
Understanding the full impact of these attacks is one thing, but identifying the culprits behind them is just as important for preventing future incidents. When security researchers began investigating the axios compromise, multiple vendors independently tracked the attacker. They used their own internal naming conventions, but eventually their work converged on the same conclusion: a specific North Korean threat actor.
You can read more on this topic in Nanoleaf Smart Multicolor Ceiling Light: Paper Plate Review.
Google, for instance, tracks the axios attacker as UNC1069. Microsoft links the same compromise to a group it calls SapphireSleet, a name that overlaps with several other vendor designations. This convergence is the result of painstaking analysis. Security researchers connect separate package compromises by studying code similarities, shared infrastructure, and common tactics, techniques, and procedures (TTPs).
The true scope of this group’s activity is broader than initially thought. The earlier compromises involving packages like typo-crypto, debug, and chalk had not been previously publicly linked to the same threat actor. It was only after Amazon’s investigation into the axios incident that researchers connected these older attacks to SapphireSleet. This revelation highlights the persistent and evolving nature of the North Korean supply chain threat.
This kind of unified threat actor attribution is vital for the open source ecosystem. When security vendors share and align their tracking data, the community gains a clearer picture of the campaign’s full reach. You can use this intelligence to better understand the risks in your own software supply chain and stay alert to the specific methods these actors employ.
Mitigation Steps and Protecting Against Supply Chain Attacks
Having a clearer picture of the campaign’s methods is valuable, but putting that knowledge into action is what truly protects your projects. Developers and organizations can take concrete steps to defend against social engineering and malicious package updates, reducing the risk of becoming part of the next North Korean supply chain attack.
Verifying Package Integrity
Security researchers have partially filled the gap in indicators of compromise by sharing file hashes for the malicious packages. These IOCs allow you to check whether your systems have been affected. The compromised packages have been cleaned or removed from NPM, but you should still verify your own installations. Compare the hashes of any packages you downloaded against the known malicious ones to be certain. This kind of dependency verification is a straightforward but effective layer of defense for your software supply chain security.
Securing Maintainer Accounts
The attackers gained access by socially engineering a trusted maintainer, which shows how vulnerable a single account can be. Account protection for maintainers is critical. Enable multi-factor authentication on every account that has publishing rights. Review dependency updates carefully before integrating them, and pin your dependencies to specific versions rather than accepting latest automatically. These practices make it much harder for malicious packages to slip into your workflow. A few minutes of verification now can prevent a serious breach later.
Frequently Asked Questions
How did the SapphireSleet group socially engineer the maintainer to gain access?
The attackers approached a trusted open-source maintainer with a plausible job opportunity, a common social engineering tactic. They guided the maintainer through a series of steps that ended with running a malicious script. That script captured session tokens, which are digital credentials that let an attacker impersonate the maintainer. With those tokens, the group bypassed the victim’s security checks and hijacked the account.
Why are open-source repositories like NPM attractive targets for hackers?
A single compromised package on a repository like NPM can reach countless projects through automated dependency updates. Developers often install packages without auditing them, and a legitimate maintainer account automatically carries trust. For a North Korean supply chain operation, the combination of massive distribution and established trust makes repositories a highly efficient infection vector.
How can software maintainers protect their accounts from social engineering?
Enable hardware-based two-factor authentication and use a unique, strong password for every repository account you manage. Treat unsolicited collaboration offers with caution, and never run commands or scripts provided by someone you haven’t verified. Review your account activity and active sessions regularly, and audit your published packages for unexpected changes. These habits close the gaps that social engineering attacks rely on.
