North Korean NPM Supply Chain Attacks: Amazon Attribution and Defensive Strategies

Introduction

Amazon's security teams have recently attributed a series of sophisticated supply chain attacks targeting the Node Package Manager (npm) ecosystem to North Korean state-sponsored actors. These attacks specifically target high-profile packages—including popular libraries like debug and chalk—through typosquatting, dependency confusion, or maintainer account compromise.

For defenders, this is a critical escalation. The npm ecosystem is a foundational component of modern web applications and CI/CD pipelines. A compromise here does not just risk a single server; it jeopardizes the entire software build lifecycle, potentially injecting malicious code into production environments across thousands of organizations. We need to shift from simply trusting our dependencies to actively verifying their integrity and behavior.

Technical Analysis

Affected Products & Platforms:

Platform: Node.js (all versions)
Ecosystem: npm registry
Environment: Development workstations, build servers, CI/CD pipelines (GitHub Actions, Jenkins, Azure DevOps)

Attack Chain & Technique: The threat actors associated with this campaign leverage the trust inherent in the open-source ecosystem. The attack typically follows this chain:

Initial Compromise: Attackers upload malicious packages to the npm registry. These packages often use names similar to legitimate libraries (e.g., debug vs de-bug) or inject code into legitimate packages if maintainer credentials are phished.
Execution (The Hook): The malicious payload is triggered via the preinstall, postinstall, or install scripts defined in package.. These scripts execute automatically when a developer runs npm install or when a CI pipeline builds the project.
Payload: The scripts typically launch reverse shells, exfiltrate environment variables (looking for AWS keys, API tokens, or credentials), or establish persistence on the developer machine.

CVE Status: This news item describes an active campaign utilizing malicious package distribution (T1195.002) rather than a specific software vulnerability (CVE). There are no CVE identifiers for this specific attribution event as it relies on social engineering and supply chain manipulation rather than a code flaw in Node.js itself.

Exploitation Status:

Confirmed Active Exploitation: Yes. Amazon has confirmed these packages are being actively used in attacks against developers and organizations.
PoC Availability: N/A (Active threat).

Detection & Response

Detecting supply chain attacks requires monitoring for anomalous behavior during the build and installation phases, rather than just looking for static indicators. The following rules focus on the execution of unauthorized scripts spawned by the Node.js package manager.

SIGMA Rules

YAML

---
title: Potential Malicious NPM Install Script Execution
id: 9a1b2c3d-4e5f-6789-0123-456789abcdef0
status: experimental
description: Detects Node.js or npm spawning shell processes, indicative of preinstall/postinstall script execution often used in supply chain attacks.
references:
  - https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.execution
  - attack.t1059.001
  - attack.supply_chain
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.cmd'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate build scripts that require shell access
level: high
---
title: NPM Process Spawning Network Utility
id: b2c3d4e5-6f78-9012-3456-7890abcdef12
status: experimental
description: Detects npm or node.exe spawning curl or wget, a common technique for exfiltrating data or downloading second-stage payloads in npm attacks.
references:
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/node'
      - '/npm'
    Image|endswith:
      - '/curl'
      - '/wget'
  condition: selection
falsepositives:
  - Developers manually testing network requests
level: medium

KQL (Microsoft Sentinel / Defender)

This query identifies suspicious child processes spawned by Node.js during installation or build times.

KQL — Microsoft Sentinel / Defender

DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in ('node.exe', 'npm.cmd', 'node')
| where FileName in ('powershell.exe', 'cmd.exe', 'bash', 'sh', 'curl', 'wget')
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, FolderPath
| order by Timestamp desc

Velociraptor VQL

Hunt for Node processes that have spawned unusual children, specifically targeting shell utilities.

VQL — Velociraptor

-- Hunt for Node.js spawning shell or network utilities
SELECT Parent.ProcessName AS ParentProcess, Parent.CommandLine AS ParentCmd, Name, CommandLine, Pid, Username
FROM pslist()
WHERE Parent.Name =~ 'node'
  AND (Name =~ 'sh' OR Name =~ 'bash' OR Name =~ 'curl' OR Name =~ 'wget' OR Name =~ 'powershell')

Remediation Script (Bash)

This script assists in auditing installed packages for known scripts that could be weaponized and runs an audit to identify vulnerable dependencies.

Bash / Shell

#!/bin/bash

# Audit npm packages for scripts and known vulnerabilities
# Usage: ./audit_npm.sh

echo "[*] Starting NPM Security Audit..."

# 1. Check for preinstall/postinstall scripts in all package. files in node_modules
# Malicious packages often use these hooks to execute code.
echo "[!] Scanning for 'install' scripts in node_modules..."
find ./node_modules -name 'package.' -exec grep -l '"preinstall"\|"postinstall"\|"install"' {} \; \
    | while read file; do
        echo "Potential script hook found in: $file"
        grep -A2 '"preinstall"\|"postinstall"\|"install"' "$file"
    done

# 2. Run standard npm audit
# This checks the registry for reported vulnerabilities.
echo "[*] Running npm audit..."
npm audit --audit-level=moderate

# 3. Review recent changes to package-lock.
echo "[!] Checking last modification of package-lock...."
if [ -f "package-lock." ]; then
    stat package-lock.
else
    echo "No package-lock. found."
fi

echo "[*] Audit complete."

Remediation

To protect your environment from these active npm supply chain attacks, implement the following defensive measures immediately:

Pin Dependency Versions: Stop using caret (^) or tilde (~) ranges in package. for critical infrastructure. Lock to exact version numbers (e.g., 1.2.3 instead of ^1.2.3) to prevent unintentional installation of malicious updates.
Enable ignore-scripts: When installing dependencies, especially in CI/CD pipelines, use the --ignore-scripts flag to prevent execution of preinstall and postinstall hooks.
- Command: npm install --ignore-scripts
Enforce Private Registries: Move internal development to use a private npm registry (e.g., AWS CodeArtifact, Sonatype Nexus, Verdaccio) and proxy the public npm registry. Configure your firewall to block developer workstations and build servers from accessing the public npm registry directly (registry.npmjs.org).
Software Bill of Materials (SBOM): Generate an SBOM for every build. Monitor for changes in the hash or origin of packages like debug and chalk using a tool like Syft or Grype.
Developer Hygiene: Enable 2FA for all npm accounts. Verify the email address and integrity of package maintainers before adding new dependencies.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub