THE UK Department for Education confirmed that a breach exposed 607 000 contact records after attackers compromised widely used NPM packages, a tactic linked to the North Korean hacking groups Saphire Sleet and STARDUST CHOLLIMA.
Investigators said the intruders used social engineering to trick package maintainers into handing over credentials, then pushed malicious updates to libraries such as axios, which when installed executed code designed to harvest environment variables and exfiltrate data to external servers.
The trojanised payloads obfuscated their behaviour, avoided detection by standard scanners and contacted command‑and‑control servers that harvested the department’s contact databases before the activity was spotted in internal logs.
AWS’s Threat Intelligence unit linked the activity to a broader campaign targeting open‑source supply chains, a connection also highlighted in a SecurityWeek roundup that noted the same groups’ involvement in multiple NPM attacks.
Defenders should enforce multi‑factor authentication on all publishing accounts, scrutinise new dependency versions before deployment and maintain lockfiles that prevent automatic updates to unverified code.
Organisations are further advised to generate a software bill of materials for every build, monitor outbound connections for unusual patterns and consider provenance verification tools such as sigstore to ensure that only trusted code enters production environments.