North Korean Actor “Sapphire Sleet” Conducts Multiple JavaScript Supply‑Chain Hacks via Compromised npm Packages
What Happened — Amazon Web Services analysis links a financially‑motivated North Korean nation‑state group (known as “Sapphire Sleet” or “Stardust Chollima”) to the insertion of trojanized code into four widely‑used npm libraries—Axios, Debug, Chalk and Typo‑Crypto. The attackers gained maintainer trust, offered genuine support, and then added malicious scripts that execute on package install.
Why It Matters for Compliance & Audit Readiness
- The incident exemplifies a supply‑chain breach that bypasses traditional perimeter controls—exactly the scenario SOC 2 vendor‑management and third‑party risk controls are designed to detect and document.
- Continuous evidence of open‑source component vetting (SBOMs, automated scanning) becomes audit‑ready proof that your organization exercised due diligence over external code.
- Mapping this supply‑chain risk to the SOC 2 CC6.1 (System Operations) and CC7.1 (Risk Management) controls shows how Verisq’s Vendor Risk capability can supply real‑time monitoring evidence for auditors.
Who Is Affected — Technology & SaaS firms, fintech platforms, Web3 projects, and any organization that builds applications with JavaScript/npm dependencies.
Recommended Actions
- Generate and maintain an up‑to‑date Software Bill of Materials (SBOM) for all production code.
- Enforce automated scanning of third‑party packages for known malicious signatures and anomalous behavior.
- Incorporate supply‑chain risk assessments into your vendor‑management program and capture continuous monitoring logs as audit evidence.
Source: DataBreachToday
Technical Notes
- Attack vector: compromised npm packages delivered via automatic install scripts.
- No public CVE; the malicious code leveraged trusted maintainer accounts and injected trojanized JavaScript that can exfiltrate credentials or crypto wallets.
- Affected packages: Axios (HTTP client), Debug (logging), Chalk (terminal styling), Typo‑Crypto (cryptographic utilities).