A trusted software update can become a malware delivery system when attackers gain control of the account publishing it.
Amazon Threat Intelligence has linked four npm supply-chain attacks conducted between March 2025 and March 2026 to Sapphire Sleet, a threat actor associated with North Korea. Based on command-and-control indicators and shared tactics, Amazon assessed the attribution with medium confidence.
The findings show why securing the people and credentials behind open-source projects can be just as important as scanning their code for vulnerabilities.
How Amazon connected four npm attacks
For nearly a year, the compromises involving Axios, Debug, Chalk, and typo-crypto appeared to be standalone security incidents.
Amazon now says command-and-control indicators, code reuse, post-install hooks, and other shared tactics connect the incidents to one campaign spanning March 2025 to March 2026. Based on that evidence, Amazon Threat Intelligence attributed the campaign with medium confidence to Sapphire Sleet, a threat actor associated with North Korea.
The Axios compromise had previously been publicly attributed to the North Korean-linked actor, according to Amazon. However, the company said the typo-crypto, Debug, and Chalk incidents had not previously been connected to the same group.
Connecting the incidents gives security teams additional indicators they can use to investigate related activity and determine whether the same campaign reached their environments.
Trust became the attack surface
Unlike many software supply-chain attacks, Amazon says this campaign did not begin with attackers discovering and exploiting a previously unknown flaw in npm packages. Instead, the group reportedly focused on the developers responsible for maintaining widely used packages, using social engineering to gain access before publishing malicious updates through legitimate accounts.
That approach gave the attackers something many security controls struggle to detect: trust.
“When an attacker compromises a widely used open source package, every organization that depends on that package is potentially affected,” Amazon wrote in its report.
The campaign illustrates an important shift in software supply-chain attacks. Instead of finding a vulnerability in the package itself, attackers can target the people authorized to update it. A malicious release published through a legitimate maintainer account may initially resemble an ordinary software update, making it harder for downstream users to recognize the compromise.
How organizations can reduce open-source supply-chain risk
Amazon’s report reflects a broader challenge facing enterprises. Open-source software is a core component of modern applications, but the ecosystem’s reliance on trusted maintainers also gives attackers an opportunity to target the people and accounts authorized to distribute code.
Organizations should not respond by abandoning open-source software altogether. Instead, development and security teams can reduce their exposure by maintaining an inventory of dependencies, pinning approved package versions, verifying package integrity, monitoring unexpected updates, and reviewing changes to package ownership or publishing permissions.
Teams should also protect developer and registry accounts with phishing-resistant multifactor authentication and limit who can publish production dependencies. Amazon’s findings show that software supply-chain security depends not only on finding vulnerabilities in code, but also on protecting the identities trusted to distribute it.
Related read: SAP npm Supply Chain Attack Targets Developer Credentials examines another campaign that used malicious packages to target developers and their credentials.