decrypted · 31 july 2026 · ransomware and cybercrime · vulnerabilities and patching · supply chain

The npm maintainer account North Korea phished, and the four packages it unlocked

Amazon's threat intelligence team said this week that four separate compromises of open source JavaScript packages, spanning March 2025 to March 2026, were the work of the same North Korea linked group, using the same method each time: not a software flaw, but a phished maintainer. The finding matters less for the packages named than for what it says about the shape of modern software, because debug, chalk and axios are not things anyone chooses to install. They arrive automatically as dependencies of dependencies, buried several layers deep in most things built with Node.js over the past decade.

What actually happened

Amazon assesses, with medium confidence, that the DPRK linked group it tracks as Sapphire Sleet, also known as Stardust Chollima, BlueNoroff, CageyChameleon and Alluring Pisces, ran the campaign. It started small: the typo-crypto package was trojanised in March 2025, apparently as a trial run. It escalated in September 2025 with debug and chalk, two of the most widely used JavaScript utility libraries, an event Amazon says reached roughly one in ten cloud environments within a two hour window, citing research from Wiz. In March 2026 the same playbook hit axios, a library with over 100 million weekly downloads. In each case the attacker socially engineered a trusted maintainer into handing over control, then published a malicious update under that maintainer's own, legitimate credentials. The motive lines up with a familiar pattern: North Korea has leaned on cyber theft to fund itself around sanctions, stealing more than two billion dollars in cryptocurrency in 2025 alone.

The Secure by Design lesson

Think of it as a single master key handed to a building caretaker on the strength of a friendly email. If someone tricks the caretaker into giving it up, every flat in the block is exposed at once, and the lock has no way to tell the caretaker's key from a stranger's. A maintainer's publish credentials work the same way across the npm ecosystem: whoever holds them can push code that quietly becomes part of every application depending on that package, usually with no human review at the point of consumption.

The fix is not "stop using open source", which is not realistic. It is engineering that assumes a maintainer account will eventually be compromised and stops that becoming an instant, wide cascade: signed publishes with verifiable provenance, which npm now supports; lockfiles pinned to content hashes rather than loose version ranges; and a deliberate delay before newly published versions are pulled automatically into a build pipeline, so an anomaly has time to surface before it reaches production. None of this is exotic. It is the same lesson the industry drew from the xz-utils backdoor uncovered in 2024, and, on this week's evidence, one it still has not fully absorbed. Any UK organisation running Node.js, which is most of them, inherits this exposure whether or not it has ever heard of Sapphire Sleet.

Also this week

Cisco confirmed active exploitation of CVE-2026-20316, a hardcoded, low-privilege account built into the web interface of Secure Firewall Management Center. CISA added it to its Known Exploited Vulnerabilities catalogue on 29 July and gave US federal agencies until 1 August to patch. The CVSS score is a modest 5.3, but Cisco rates it high severity because the static account can be chained with other, undisclosed FMC flaws to escalate privileges. A hardcoded password remains one of the oldest and most preventable design mistakes on record, and this is a large firewall management platform, not a hobbyist project.

The extortion group ShinyHunters added Ernst & Young to its leak site, claiming data taken through a supply chain compromise of a third party IT support platform, and setting a deadline of 31 July for EY to make contact. EY has confirmed that a third party IT service management platform was accessed by an unauthorised party between 28 March and 12 April, exposing documents tied to client tax filings, and is offering affected clients identity monitoring. It has not confirmed ShinyHunters' involvement or the wider scope the group claims. Treat the group's additional assertions as claims until EY says otherwise.

The NCSC published new guidance, "What to do when cyber-attacks disrupt your organisation", on 28 July, structured around three stages: immediate response, recovery to minimum viable operations, and the longer rebuild. Its central point is one that UK boards routinely skip: a plan that has only ever been written down, never rehearsed, is not a plan. Organisations should test disruption scenarios with the same seriousness as a fire drill, well before the moment they need the NCSC's own number for live attacks.

Sources

If you want to talk through what any of this means for your own systems, get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.