Loading story…
Amazon Threat Intelligence said a North Korea-linked, financially motivated threat actor was tied to four open-source software supply-chain compromises dating back to March 2025. With medium confidence, researchers linked the same actor to malicious updates published for the JavaScript packages typo-crypto, debug, chalk, and axios, after trusted maintainers were reportedly tricked into releasing the tainted versions. The campaign targeted widely used dependencies, including axios, which receives more than 100 million weekly downloads, creating potential exposure across thousands of downstream systems through routine dependency updates.
Amazon said the actor reused code and similar tradecraft across the incidents, indicating a broader coordinated operation rather than isolated package compromises. Researchers warned that attackers are increasingly spreading malicious functionality across multiple packages to make detection harder, while also using AI to produce more convincing code, documentation, and fake developer personas; the report added that coding assistants can further increase risk when they recommend nonexistent package names that attackers later hijack.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Amazon Threat Intelligence linked a March 2026 compromise of the popular npm package axios to the same DPRK-associated supply-chain campaign that previously hit typo-crypto, debug, and chalk. The report said attackers compromised a trusted maintainer and published a malicious update as part of a financially motivated downstream access operation.
Amazon researchers said the same North Korea-linked actor later compromised the npm packages debug and chalk in September 2025 after first targeting typo-crypto in March. Wiz found the debug and chalk incident spread rapidly, affecting about 1 in 10 cloud environments within two hours.
Amazon researchers said a financially motivated North Korea-linked actor was tied to four open-source software supply-chain compromises dating back to March 2025. The campaign involved the JavaScript packages typo-crypto, debug, chalk, and axios, with attackers reportedly tricking trusted maintainers into publishing malicious updates.
Amazon said the open-source supply-chain compromises affecting typo-crypto, debug, chalk, and axios were carried out by the North Korea-linked threat actor SapphireSleet. The report also said the malware used in the campaign is tracked in the Open Source Vulnerabilities database as MAL-2026-3400.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
15 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcescworld.com
Open sourceinfosecurity-magazine.com
Open sourcebleepingcomputer.com
Open sourcemalware.news
Open sourcenextgov.com
Open sourcewiz.io
Open sourceaikido.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean state-sponsored threat actors have significantly escalated their 'Contagious Interview' campaign by flooding the npm registry with over 338 malicious packages designed to steal cryptocurrency and sensitive credentials. The operation leverages a repeatable playbook, with threat actors creating more than 180 fake personas and using new npm aliases and registration emails to distribute the malware. These malicious packages have collectively been downloaded over 50,000 times, indicating a substantial reach and potential impact on the developer community. The attackers primarily target Web3, cryptocurrency, and blockchain developers, as well as technical job seekers, often approaching them on LinkedIn under the guise of recruiters or hiring managers. The campaign follows a multi-stage attack chain, beginning with reconnaissance on social media, followed by weaponization through the publication of typosquatted npm packages. Delivery occurs via recruiter lures, leading to exploitation through malware loaders that execute in memory. The malware tooling has evolved, with initial stages using direct BeaverTail droppers, and more recent waves employing HexEval, XORIndex, and encrypted loaders that reconstruct BeaverTail in memory. Once executed, these loaders typically fetch the InvisibleFerret backdoor, which establishes persistence and enables further malicious actions. The attackers use over a dozen command and control endpoints to manage the compromised systems. The campaign is iterative, with new malicious packages appearing weekly and loader code being regularly tweaked to evade detection. The npm security team has been notified, and takedown requests have been submitted, but as of the latest reports, 25 malicious packages remain live on the registry. The operation has resulted in multi-stage compromises, including the theft of wallet keys and sensitive credentials, leading to financial losses for victims. The attackers' use of social engineering, technical obfuscation, and rapid distribution across new aliases demonstrates a high level of sophistication and adaptability. The campaign has been mapped to the Lockheed Martin Cyber Kill Chain, illustrating its comprehensive approach from reconnaissance to actions on objectives. Security researchers emphasize the need for heightened vigilance among developers, especially those in the cryptocurrency and blockchain sectors, and recommend immediate review of npm dependencies and enhanced monitoring for suspicious package activity. The ongoing nature of the campaign and the attackers' ability to quickly adapt their tactics pose a persistent threat to the software supply chain. Organizations are urged to implement robust security controls, educate staff about social engineering risks, and coordinate with npm and security vendors to mitigate exposure. The incident highlights the growing risk of supply chain attacks via open-source ecosystems and the need for industry-wide collaboration to address such threats.
Jun 29, 2026A suspected North Korean threat actor compromised a maintainer account for the widely used open-source package **Axios** and pushed malicious updates for about three hours in a software supply-chain attack, according to reporting from CNN, NK News, and security researchers cited by both outlets. Google Threat Intelligence Group and Mandiant linked the operation to North Korean actors, saying the attackers likely sought information to support follow-on intrusions and cryptocurrency theft. Axios is broadly embedded in web applications and server-to-server communications, raising concern that the compromise could affect organizations across healthcare, finance, and cryptocurrency-related sectors. Incident responders said the known impact was still developing, with Huntress identifying roughly **135 compromised devices across about 12 companies** while warning the downstream victim count could grow substantially because Axios is used by thousands of enterprises. Researchers said the campaign fits Pyongyang’s established pattern of using cyber operations for revenue generation and strategic access, and warned that determining the full scope of exposure and any secondary compromises could take months.
Jun 29, 2026
Open-source software supply chain risk continued to escalate, with reporting citing **454,600+** newly identified malicious packages across major repositories (including **PyPI, npm, Maven Central, NuGet, and Hugging Face**) and tactics ranging from **credential theft** to **multi-stage attacks** and even early **self-replicating** package malware. The activity reportedly concentrated heavily in **npm**, including high-volume “ecosystem flooding” (e.g., single accounts publishing **150,000+** malicious packages in days) and **hijacking of trusted projects**, exploiting developer reliance on superficial trust signals such as package names, READMEs, and download counts. Separately, researchers disclosed **“PackageGate”** vulnerabilities in JavaScript package managers (**npm, pnpm, vlt, and Bun**) that can bypass common post-incident defenses—namely `--ignore-scripts` and lockfile integrity—enabling malicious code execution via compromised dependencies. Koi Security reported six issues; **pnpm, vlt, and Bun** shipped fixes, while **npm** reportedly treated the behavior as expected. In parallel, threat actors abused **GitHub’s fork architecture** to distribute a spoofed *GitHub Desktop* installer promoted via search ads; execution deployed **HijackLoader** and established persistence via a **scheduled task**, underscoring that supply chain threats extend beyond package registries into developer tooling distribution channels.
Jun 29, 2026