A little-known npm package was North Korea’s warm-up act for the axios hack

Amazon security researchers linked a North Korea–affiliated hacking group to multiple supply-chain compromises of open-source JavaScript packages (typo-crypto, debug, chalk, and axios), where attackers gained maintainer trust to publish updates containing obfuscated, multi-stage malicious code that activated under specific conditions and fetched OS-specific payloads — a high-impact, sophisticated campaign that rapidly affected cloud environments and demonstrates evolving nation-state abuse of open-source supply chains.