🟠 High | Source: AWS Security Blog
Amazon’s threat intelligence team has attributed a series of attacks on popular NPM libraries to a North Korean state-sponsored hacking group. The attackers are compromising open-source packages used widely in application development, meaning malicious code could be silently introduced into software built by organisations around the world. This is a significant supply chain threat, as developers often trust and automatically consume these shared libraries.
Security Architect’s Take: Audit your CI/CD pipelines and dependency manifests for recently updated NPM packages, and implement software composition analysis (SCA) tooling to flag unexpected changes in transitive dependencies. Consider enforcing package integrity checks via lockfiles and private registries with allowlisting to reduce exposure to compromised upstream packages.
Original advisory: Amazon identifies North Korean hacker group behind open-source supply chain attacks