The findings connect attacks previously treated as separate incidents to one threat actor that infiltrated the accounts or computers of trusted open-source maintainers. The attackers then published malicious updates capable of stealing credentials, installing remote-access tools and opening thousands of downstream systems to further intrusion.
Amazon Threat Intelligence assessed with medium confidence that the campaigns were conducted by a group tracked under several names, including Sapphire Sleet, Stardust Chollima, BlueNoroff, CageyChameleon and Alluring Pisces. The attribution was based on common command-and-control infrastructure, reused code and consistent attack methods.
The operation appears to have started on a limited scale with the compromise of typo-crypto in March 2025. A malicious file named core. js was inserted into the package while masquerading as the legitimate and widely used core-js component.
The relatively small number of downloads indicated that the incident may have served as a testing ground. The attackers subsequently moved against packages with far greater reach, refining a model that allowed them to penetrate many organisations through a single compromised developer.
Debug and Chalk were targeted in September 2025. Both are deeply embedded in the JavaScript ecosystem and can be pulled into applications indirectly through other dependencies. Around one in 10 monitored cloud environments was exposed to the poisoned packages within a two-hour period, illustrating how quickly malicious code can spread through automated software builds.
The Axios compromise in March 2026 marked the campaign’s most prominent attack. Axios is a JavaScript library used to handle communications between applications and web services, with its principal release receiving more than 100 million downloads a week.
Attackers gained access to the computer of lead Axios maintainer Jason Saayman after a targeted social-engineering operation that began about two weeks before the malicious packages appeared. Remote-access malware installed on the device exposed credentials used to publish software to the npm registry.
Two compromised Axios versions, 1.14.1 and 0.30.4, were uploaded on March 31. They contained a dependency called plain-crypto-js version 4.2.1, designed to resemble legitimate cryptographic software.
The malicious dependency used an npm “postinstall” command, which automatically runs code when a package is installed. Its obfuscated downloader identified the victim’s operating system and deployed a remote-access trojan tailored for Windows, macOS or Linux.
The malware could collect system information, execute commands and retrieve additional payloads from attacker-controlled infrastructure. It also attempted to delete parts of its installation mechanism and restore altered files, reducing the forensic traces available to investigators.
The poisoned Axios releases remained available for about three hours. They were published at 00:21 UTC and around 01:00 UTC before being removed by 03:15 UTC. The associated plain-crypto-js package was taken down shortly afterwards.
Community members began reporting the suspicious releases within an hour, but some reports were deleted through the compromised maintainer account. Developers who installed Axios during the affected window were advised to treat their machines as breached, remove the malicious dependency and rotate every exposed password, token and cloud credential.
Investigators linked the Axios malware to UNC1069, a North Korea-associated group active since at least 2018 and known for targeting cryptocurrency businesses. Infrastructure used in the operation overlapped with systems connected to earlier UNC1069 activity, while the deployed backdoor was an upgraded form of malware previously associated with the group.
The attacks point to a financially driven strategy rather than conventional espionage. Access to development systems can expose cryptocurrency wallets, cloud accounts, software-signing credentials and corporate secrets. Stolen publishing tokens can also enable attackers to compromise additional packages and extend the operation through trusted software channels.
Generative artificial intelligence is further changing the threat environment by helping attackers create convincing developer identities, improve social-engineering messages and produce packages that appear more credible. Security systems that rely only on superficial code patterns may struggle to distinguish these submissions from legitimate projects.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
