The Hacker Newsinfo@thehackernews.com (The Hacker News)
North Korea's Sapphire Sleet hijacks npm packages via Amazon links
Part of the STARDUST CHOLLIMA story · since 1 Apr
Quiet for 32 hourslast report 29 Oct9 articles5 outlets
- Wed 1 Apr, 22:15 UTC. Microsoft, first report. Mitigating the Axios npm supply chain compromise.
- Wed 22 Apr, 11:01 UTC. SecurityWeek, its first report on the story. North Korean hackers use AppleScript, ClickFix on macOS finance.
- Mon 22 Jun, 11:30 UTC. SecurityWeek. North Korean Group Targets NPM Supply Chain, 8M Devs at Risk.
- Mon 22 Jun, 11:31 UTC. Infosecurity, its first report on the story. North Korean hackers breach Mastra via tainted npm packages.
- Thu 30 Jul, 07:20 UTC. The Hacker News, its first report on the story. North Korea's Sapphire Sleet hijacks npm packages via Amazon links. This article, 5th of 9.
- Fri 31 Jul, 16:10 UTC. SecurityWeek. UK Education Dept Breach Exposes 607k Records After NPM Attack.
- Tue 4 Aug, 09:31 UTC. SecurityOnline, its first report on the story. North Korean Hackers Hijack NPM Packages via Social Engineering.
- Fri 21 Aug, 09:30 UTC. SecurityWeek. North Korean hackers breach Rust supply chain via crate arrayref.
- Thu 29 Oct, 18:30 UTC. Microsoft. Microsoft reports North Korean groups expanding AI operations.
The article discusses a recent cybersecurity threat involving an npm hijack linked to North Korea's Sapphire Sleet group. It outlines how malicious actors exploited vulnerabilities in Amazon links and npm packages, potentially impacting a wide range of software security. Key points include the methods used for the hijack, the implications for software developers, and recommended measures to bolster security against such attacks.
How the story developed
Quiet for 32 hourslast report 29 Oct9 articles5 outlets
9 articles from 5 outlets since 1 Apr. Quiet since 29 Oct. This was the 5th report, 119 days after the first.
- Wed 1 Apr, 22:15 UTC. Microsoft, first report. Mitigating the Axios npm supply chain compromise.
- Wed 22 Apr, 11:01 UTC. SecurityWeek, its first report on the story. North Korean hackers use AppleScript, ClickFix on macOS finance.
- Mon 22 Jun, 11:30 UTC. SecurityWeek. North Korean Group Targets NPM Supply Chain, 8M Devs at Risk.
- Mon 22 Jun, 11:31 UTC. Infosecurity, its first report on the story. North Korean hackers breach Mastra via tainted npm packages.
- Thu 30 Jul, 07:20 UTC. The Hacker News, its first report on the story. North Korea's Sapphire Sleet hijacks npm packages via Amazon links. This article, 5th of 9.
- Fri 31 Jul, 16:10 UTC. SecurityWeek. UK Education Dept Breach Exposes 607k Records After NPM Attack.
- Tue 4 Aug, 09:31 UTC. SecurityOnline, its first report on the story. North Korean Hackers Hijack NPM Packages via Social Engineering.
- Fri 21 Aug, 09:30 UTC. SecurityWeek. North Korean hackers breach Rust supply chain via crate arrayref.
- Thu 29 Oct, 18:30 UTC. Microsoft. Microsoft reports North Korean groups expanding AI operations.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 9 articles as a listHide the list
- Wed 1 AprDay 01
- Mitigating the Axios npm supply chain compromise22:15 · Microsoft · First report
Quiet for 3 weeks
Wed 22 AprDay 211- North Korean hackers use AppleScript, ClickFix on macOS finance11:01 · SecurityWeek · Picked up again
Quiet for 9 weeks
Mon 22 JunDay 822- North Korean Group Targets NPM Supply Chain, 8M Devs at Risk11:30 · SecurityWeek · Picked up again
- North Korean hackers breach Mastra via tainted npm packages11:31 · Infosecurity
Quiet for 5 weeks
Thu 30 JulDay 1201- North Korea's Sapphire Sleet hijacks npm packages via Amazon links07:20 · The Hacker News · Picked up again · This article, 5th of 9
- Fri 31 JulDay 1211
- UK Education Dept Breach Exposes 607k Records After NPM Attack16:10 · SecurityWeek
Quiet for 4 days
Tue 4 AugDay 1251- North Korean Hackers Hijack NPM Packages via Social Engineering09:31 · SecurityOnline · Picked up again
Quiet for 2 weeks
Fri 21 AugDay 1421- North Korean hackers breach Rust supply chain via crate arrayref09:30 · SecurityWeek · Picked up again
Quiet for 10 weeks
Thu 29 OctDay 2111- Microsoft reports North Korean groups expanding AI operations18:30 · Microsoft · Picked up again