North Korean Hackers Pivot to Open-Source Packages
Amazon security researchers have formally linked a wave of open-source supply chain attacks in the Node Package Manager (npm) ecosystem to Sapphire Sleet, a North Korean state-sponsored threat group also known as BlueNoroff and Stardust Chollima.
The campaign was not an overnight operation. According to Amazon, Sapphire Sleet began testing its pipeline in March 2025 by trojanizing typo-crypto, using the minor package to fine-tune automated publishing and payload distribution. By September 2025, the attackers escalated their focus to foundational utility packages like debug and chalk. When poisoned releases hit the npm registry, the blast radius was immediate—affecting roughly 10% of cloud environments within two hours.
In March 2026, the group targeted axios, a ubiquitous HTTP client package downloaded over 100 million times per week. While earlier security reports linked the axios breach to North Korean actors, Amazon's technical synthesis connects the C2 infrastructure, payload delivery tactics, and operational tradecraft directly to Sapphire Sleet with medium confidence.
Rather than attempting to breach thousands of enterprise networks individually, the threat actor used social engineering to hijack package maintainer credentials. Once inside, they pushed trojanized updates directly through trusted package distribution channels, executing malicious code inside downstream developer workstations and automated CI/CD pipelines worldwide.
Understanding AI Cybersecurity Threats and Modern Supply Chain Vulnerabilities
Analyzing these recent package compromises highlights how ai cybersecurity threats are reshaping software supply chain security. Threat actors no longer rely on simplistic backdoor scripts that get flagged by basic static analysis tools. Instead, Sapphire Sleet and related APT groups have adopted a much subtle tactical playbook.
Modern attack trends identified by Amazon researchers include:
- Split Package Functionality: Attackers divide malicious code across multiple seemingly benign packages. A single dependency appears clean on its own, but executes its complete payload when combined with companion libraries at runtime.
- Long-Term Trust Building: Threat actors spend months maintaining legitimate open-source projects or contributing pull requests to build reputation before introducing backdoors.
- Decoupled Execution and Sandbox Evasion: Malicious code relies on external servers or runtime checks. The payload delays execution unless it detects a genuine developer machine or production environment, evading automated analysis sandboxes.
- Slopsquatting via AI Code Generation: Cybercriminals increasingly target "slopsquatting," registering package names hallucinated by AI coding assistants. When developers or autonomous AI agents follow generated code snippets or tutorial guides without checking registry names, they unwittingly install malicious packages.
Furthermore, attackers are leveraging artificial intelligence tools to craft convincing maintainer personas, generate plausible documentation, and automate obfuscation routines.
The Mastra AI Incident: Typosquatting and Multi-Stage Droppers
The group's focus on AI development ecosystems became undeniable in June 2026 when Microsoft disclosed a major supply chain attack targeting Mastra AI.
Microsoft attributed the compromise of over 140 packages under the @mastra npm scope to Sapphire Sleet. The attackers compromised the account of maintainer "ehindero" and published updates injecting a malicious dependency named easy-day-js. The dependency acted as a typosquat for dayjs, a widely used JavaScript date utility library.
When developers installed the compromised Mastra packages, a postinstall hook executed an obfuscated dropper script. To ensure successful communication with attacker-controlled command-and-control servers, the dropper explicitly disabled Transport Layer Security (TLS) certificate verification. It then fetched a cross-platform information stealer that ran as a detached hidden process across Windows, Linux, and macOS systems.
The second-stage payload harvested system details, browser history, and targeted 166 specific cryptocurrency wallet browser extensions, including MetaMask, Phantom, Coinbase Wallet, Binance Wallet, and TronLink. On compromised hosts, the malware established persistence using OS-native methods like Windows Registry Run keys, macOS LaunchAgents, and Linux systemd services. Follow-on activity included dropping a PowerShell backdoor and creating a malicious Windows service with elevated SYSTEM privileges.
Jscrambler Backdoor Targets Agentic AI Tools and Cloud Secrets
Just weeks after the Mastra AI incident, another critical npm supply chain attack surfaced. In July 2026, client-side web security vendor Jscrambler disclosed that threat actors had published unauthorized versions of its jscrambler npm package.
The compromise affected package releases 8.14, 8.16, 8.17, and 8.20. Jscrambler's primary package sees over 17,000 weekly downloads to protect web applications from code tampering and reverse engineering. Although Jscrambler revoked the compromised credentials and released safe version 8.22 within two hours, registry telemetry showed the malicious package was downloaded 1,479 times during that window. Four secondary Jscrambler packages were also deprecated as a precaution.
Security firm Socket analyzed the backdoor and found a preinstall hook that deployed an infostealer. The malware utilized heavy ChaCha20-Poly1305 symmetric encryption for string obfuscation to resist static analysis.
The stealer specifically targeted developer assets, including source code, Git credentials, SSH keys, environment variables, CI/CD tokens, and cloud access keys across AWS, Azure, GCP, and Kubernetes clusters. Crucially, the malware also searched for configuration files tied to agentic AI tools and coding environments, extracting sensitive data from Claude, Cursor, Windsurf, Zed, and VS Code.
Ecosystem Defenses and Securing Developer Workflows
The rapid progression of attacks across debug, chalk, axios, Mastra AI, and Jscrambler proves that traditional dependency management is insufficient against state-sponsored actors, echoing broader risks seen in zero-day supply chain breaches.
To combat these threats, Amazon announced a $12.5 million investment in the Akrites initiative, partnering with the Open Source Security Foundation (OpenSSF) to build automated defenses against AI-driven supply chain attacks. Meanwhile, organizations are increasingly adopting agentic cybersecurity platforms to continuously monitor code repositories and enforce runtime controls.
Security teams and developers must implement stricter defensive controls aligned with Cybersecurity Best Practices recommended by organizations like CISA and industry frameworks from threat researchers at IBM. Recommended defenses include:
- Enforce Strong Authentication: Require multi-factor authentication (MFA) and hardware security keys for all npm publishing accounts and maintainer access.
- Restrict Lifecycle Hooks: Disable unvetted
preinstallandpostinstallscripts during package installation using flags like--ignore-scriptsin CI/CD pipelines. - Audit AI-Generated Dependencies: Verify all package names generated by AI coding assistants to prevent slopsquatting compromises before adding dependencies to
package.json. - Monitor Environment Integrity: Use runtime behavioral security tools to detect unexpected outbound traffic, TLS verification bypasses, or unauthorized credential access on developer workstations.
Securing open-source software requires treating third-party dependencies with zero trust. As nation-state groups refine their tactics, automated verification and continuous monitoring are essential to keeping developer pipelines secure.
