cyber-crime
Researchers say Sapphire Sleet socially engineered maintainers before publishing malicious updates through trusted accounts
Amazon has linked the compromises of four npm packages over the past 18 months, saying they were all the work of the same North Korean crew.In research published this week, AWS attributed the activity with medium confidence to the North Korea-linked group tracked as Sapphire Sleet, which is widely regarded as a Lazarus Group offshoot. Rather than exploiting zero-days or hacking npm itself, the crew allegedly took the slower route of befriending maintainers, stealing credentials, and publishing poisoned updates from accounts that developers already trusted.The research revisits the compromises of typo-crypto, chalk and debug, and Axios, concluding that the four packages were targeted by the same North Korean operation.
Google had already attributed the Axios compromise to Sapphire Sleet, which it tracks as UNC1069, but Amazon goes further, saying the same group was behind all four incidents. The company points to shared infrastructure and technical overlaps, alongside similarities in how the attacks were carried out and which packages were targeted.
Rather than attacking npm's infrastructure, the group allegedly went after the people trusted to publish code. Once a maintainer account was compromised, malicious releases could be pushed through the same channels developers use every day. AWS says the targets also grew more ambitious, progressing from little-known packages to some of the ecosystem's biggest names.AWS says this strategy is as much about economics as espionage. Instead of picking off victims individually, compromising a small number of widely used packages offers a shot at thousands of downstream environments in one go. AWS warns that generative AI is making this kind of operation easier to sustain by helping attackers create believable developer personas, tailor messages to individual maintainers, and keep long-running social engineering campaigns convincing enough to earn their targets' trust.
