Amazon Ties North Korea to String of Cyberattacks on Open-Source Software

Amazon has linked a series of cyberattacks on open-source software packages to a single North Korean hacking group. The company argued that the compromises were part of a coordinated campaign rather than isolated incidents. The affected packages include Axios, Debug, Chalk, and typo-crypto, a package named to mimic the legitimate 'crypto' library through typo-squatting.

Amazon's security team identified the attacks as originating from a group with ties to the North Korean government. The methods involved inserting malicious code into packages that developers might mistakenly download due to typos or confusion over package names. The compromises were discovered during routine monitoring of open-source repositories.

The implications of the campaign are significant for open-source supply chain security. The attack on typo-crypto highlights a common vector where malicious packages mimic popular libraries. Amazon has not disclosed whether any customers were affected, but the company stated it has shared its findings with the broader security community. The attribution to a state actor underscores the increasing geopolitical dimension of open-source software attacks.