North Korea Used Obscure npm Package as a Dress Rehearsal Before the Axios Hack

North Korean hackers likely used typo-crypto as a trial run before targeting axios, affecting 1 in 10 cloud environments in just hours.

By Content Team

Jul 30, 2026

ON THIS PAGE

Amazon's security team assesses with medium confidence that a North Korean hacking group — tracked as UNC1069, Sapphire Sleet and Stardust Chollima — quietly compromised a small npm package called typo-crypto in March 2025, a full year before attacking axios, one of the internet's most downloaded libraries at 100 million weekly downloads.

Amazon CISO CJ Moses called typo-crypto a "rehearsal" — a low-profile test run to refine the group's methods before hitting bigger targets, without "putting that on the big stage." The attackers didn't break in: "They basically earned the trust of an employee to hand them the keys," Moses said.

Two other packages, debug and chalk, were also hit in September 2025. Wiz found roughly 1 in 10 cloud environments were affected within just two hours.

Source: CyberScoop

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?