TLDR Tech / InfoSec
Amazon identifies North Korean hacker group behind open-source supply chain attacks
Amazon Threat Intelligence has attributed the compromises of major NPM packages, including axios, debug, and chalk, to the DPRK-linked actor SAPPHIRE SLEET, linking four distinct supply chain campaigns for the first time. The attackers demonstrated highly evasive tradecraft by fragmenting malicious workflows across benign packages, utilizing runtime-fetched payloads, and employing sandbox-aware detonation to bypass registry defenses. Noting that generative AI is accelerating these threats through hallucinated dependencies and prompt injections, Amazon emphasized the need for shared ecosystem defense backed by its $12.5M Akrites investment with the Linux Foundation.
Read the full story