Amazon has attributed multiple supply chain attacks on the Node Package Manager ecosystem to North Korean threat actors. The attacks targeted popular open-source packages Debug and Chalk.
Amazon's security team identified the campaigns as part of a broader effort to compromise the npm software repository. The attackers injected malicious code into widely-used packages, potentially exposing thousands of developers and applications.
The Debug and Chalk packages are fundamental tools in Node.js development, giving the attacks significant reach across the JavaScript ecosystem. Compromised versions could allow attackers to execute arbitrary code on developer machines or in production environments.
This marks a notable escalation in supply chain security threats, as nation-state actors increasingly target open-source infrastructure. npm, owned by GitHub, hosts millions of packages critical to modern software development.
Amazon's attribution follows enhanced scrutiny of open-source security after similar campaigns in 2024. The company did not disclose specific technical indicators but indicated the attacks align with known North Korean hacking tradecraft and infrastructure patterns.
The findings underscore growing risks in the software supply chain and the need for stronger package vetting and monitoring mechanisms.
Framework's customer database was compromised in a data breach, though payment information was not exposed. The company has disclosed the incident to affected users.
Security researchers have identified potential hardware backdoors in certain x86 processors. The findings, detailed in a GitHub repository called Rosenbridge, reveal vulnerabilities at the processor level that could allow unauthorized access.
Flock Safety, the traffic camera company, is expanding beyond law enforcement with plans to deploy dashcams in rideshare vehicles and offer coaching services to police departments.
A sharp rise in explicit deepfake images of UK children has been reported by an online safety service, as authorities warn that AI tools are making the creation of sexualized or 'nudified' content increasingly accessible.