Amazon researchers linked the North Korea-backed group Sapphire Sleet to four npm package compromises. These incidents occurred over the past 18 months.
The affected software includes the popular HTTP client axios, which receives over 100 million weekly downloads. Other compromised packages include debug, chalk, and typo-crypto.
Attackers used social engineering to gain access to maintainer accounts and publish malicious updates. This coordinated campaign injected malware into downstream development environments, exposing significant risks in the open-source software supply chain.