'Generative AI is already changing what malicious software packages look like and how threat actors are beginning to probe AI-based code systems': Amazon flags North Korean hacker group as being behind the surge in open source supply chain attacks
Amazon linked a North Korean hacking group to software supply chain attacks while warning generative AI is changing malware development techniques.
A North Korean hacking group has been linked to a surge in software supply chain attacks targeting popular NPM libraries, according to Amazon's Threat Intelligence report. This group, known by various aliases including SAPPHIRE SLEET and BlueNoroff, has been exploiting trust in widely used packages to distribute compromised software updates undetected.
The attacks began with the compromise of the typo-crypto package in March 2025, followed by the debug and chalk packages in September 2025 and axios in March 2026. Axios alone has over 100 million weekly downloads, making it a prime target. In each case, attackers exploited trust by socially engineering a trusted maintainer to publish malicious updates.
Amazon estimates that approximately one in ten cloud environments were affected within two hours of the debug and chalk incident, illustrating the efficiency of targeting numerous downstream environments simultaneously. The group's tactics have evolved to fragment workflows across multiple dependencies, making detection more challenging.
The introduction of generative AI has exacerbated the threat, allowing attackers to create convincing malware with coherent code, documentation, and fabricated identities. This makes it difficult for traditional antivirus tools to detect, as no single stable signature persists. Attackers have also exploited slopsquatting, registering package names AI coding assistants might suggest during development.
Amazon is taking steps to mitigate these risks, investing in Amazon Inspector and contributing to the Linux Foundation's Akrites initiative. However, the shift towards AI-generated malware suggests that traditional pattern matching may become less effective against evolving threats, including potential ransomware campaigns employing similar techniques.
Written by urgent.news from TechRadar's reporting — not their text. Machine-written — it may contain errors, so check the original before relying on it.
