Amazon has attributed multiple supply chain attacks on the Node Package Manager ecosystem to North Korean threat actors. The attacks targeted popular open-source packages Debug and Chalk.
Amazon's security team identified the campaigns as part of a broader effort to compromise the npm software repository. The attackers injected malicious code into widely-used packages, potentially exposing thousands of developers and applications.
The Debug and Chalk packages are fundamental tools in Node.js development, giving the attacks significant reach across the JavaScript ecosystem. Compromised versions could allow attackers to execute arbitrary code on developer machines or in production environments.
This marks a notable escalation in supply chain security threats, as nation-state actors increasingly target open-source infrastructure. npm, owned by GitHub, hosts millions of packages critical to modern software development.
Amazon's attribution follows enhanced scrutiny of open-source security after similar campaigns in 2024. The company did not disclose specific technical indicators but indicated the attacks align with known North Korean hacking tradecraft and infrastructure patterns.
The findings underscore growing risks in the software supply chain and the need for stronger package vetting and monitoring mechanisms.
A former NSA official has warned against connecting water infrastructure controllers to the internet following suspected Iranian cyberattacks on U.S. water systems.
Security researchers scanning Polish government websites discovered critical vulnerabilities that could expose courts, hospitals, and airports to cyberattacks. The vulnerabilities stem from common software used to manage and display web content.
A critical SQL injection vulnerability in Metabase is being actively exploited in the wild to steal customer data. The zero-day attack has already compromised instances at Framework and Tally.
Healthcare software company Unlimited Technology Systems disclosed a data breach affecting 3.8 million individuals. The breach occurred in October 2025.