Amazon Links Typo-Crypto Attack to North Korea-Linked Group Behind Axios Compromise
Summary
Amazon researchers linked the March 2025 typo-crypto attack and September 2025 debug and chalk compromises to the North Korea-linked group also tied to the axios compromise, describing maintainer trust abuse and staged malicious code.
Key points
- Amazon linked the March 2025 typo-crypto attack to the North Korea-associated group it connects to the axios compromise; researchers believe typo-crypto was a rehearsal.
- Amazon said the group also compromised debug and chalk in September 2025, using trusted maintainer access to publish updates with hidden code.
- The typo-crypto file core.js mimicked core-js, activated on a specific numeric input, and contacted an attacker-controlled server to download a second-stage payload.
- The second-stage code varied by operating system and combined encoded text with a cipher to hinder analysis.
- Wiz separately found that about 1 in 10 cloud environments were affected by the debug and chalk incident within two hours.
- Amazon researchers said generative AI can help attackers create convincing code and documentation, and that AI coding suggestions may lead developers to malicious package names.
Article Details
- Event Type
- Reported open-source software supply-chain compromises attributed by Amazon to the same North Korea-associated hacking group, involving malicious package updates.
- Impact
- Amazon said the group compromised typo-crypto in March 2025 and debug and chalk in September 2025, and linked the activity to the later axios compromise. Wiz separately found that about 1 in 10 cloud computing environments were affected by the debug and chalk incident within two hours. Amazon researchers described typo-crypto as a possible rehearsal; that characterization is their assessment.
People
CJ MosesAmazon's chief information security officer; discussed Amazon's assessment that the typo-crypto campaign may have been a rehearsal and described the attack pattern.Rick AnthonySenior engineering manager at Amazon Web Services; discussed how attackers build maintainer trust and use malicious package updates.
Threat Actors
Sapphire SleetAmazon linked this North Korea-associated group to the typo-crypto, debug, and chalk compromises and the later axios compromise. The article identifies Sapphire Sleet as one of several names used by security researchers for the same group.STARDUST CHOLLIMAAmazon linked this North Korea-associated group to the typo-crypto, debug, and chalk compromises and the later axios compromise. The article identifies Stardust Chollima as one of several names used by security researchers for the same group.TeamPCPThe article says TeamPCP compromised and injected malicious code into more than 1,000 software packages over a four-month span.UNC1069Amazon linked this North Korea-associated group to the typo-crypto, debug, and chalk compromises and the later axios compromise. The article identifies UNC1069 as one of several names used by security researchers for the same group.
Vendors
AmazonAmazon researchers say a North Korea-linked hacking group used the tiny typo-crypto package as a rehearsal before later compromising the widely used axios library and other open-source packages.WizCybersecurity firm Wiz separately found that about 1 in 10 cloud computing environments were affected by the debug and chalk incident within a two-hour span, a finding Moses cited to illustrate how fast the impact
Products
AxiosAmazon researchers say a North Korea-linked hacking group used the tiny typo-crypto package as a rehearsal before later compromising the widely used axios library and other open-source packages.Chalk#UNC1069Debug#UNC1069typo-cryptoAmazon researchers say a North Korea-linked hacking group used the tiny typo-crypto package as a rehearsal before later compromising the widely used axios library and other open-source packages.