Amazon uncovers broad North Korean hacking campaign against open-source software

Amazon Threat Intelligence linked a North Korea-associated hacking group to the compromise of four popular JavaScript packages (typo-crypto, debug, chalk and axios), where attackers tricked maintainers into publishing malicious updates. The supply-chain nature of the campaign, the massive downstream reach (axios has ~100M weekly downloads), reuse of code and multi-package stealth techniques increase the potential impact and detection difficulty, and Amazon assigned medium confidence to the attribution.