North Korea compromised 140 npm packages in Mastra AI attack
Microsoft attributes supply chain breach to Sapphire Sleet, marking escalation in state-sponsored targeting of developer infrastructure.
Microsoft has linked a supply chain attack that compromised more than 140 npm packages to Sapphire Sleet, a North Korean state-sponsored hacking group also tracked as BlueNoroff. The breach targeted Mastra AI, an open-source framework for building AI applications.
The attack represents a significant escalation in North Korean cyber operations against software supply chains. By poisoning packages in the npm ecosystem—the world's largest software registry—the attackers positioned themselves to reach thousands of downstream developers and their enterprise customers. The compromised packages were distributed through the npm repository, which serves the JavaScript and Node.js development community.
Sapphire Sleet has previously focused on cryptocurrency theft and financial fraud to fund North Korean state operations. This pivot to supply chain compromise suggests the group is expanding its operational scope beyond immediate financial gain to longer-term access and intelligence collection. Microsoft's attribution carries weight given the company's visibility into global threat activity through its security products and telemetry.
- 01Development teams using npm packages must audit dependencies for compromise indicators
- 02Open-source maintainers face heightened scrutiny over repository security practices
- 03North Korean cyber operations now target developer infrastructure for persistent access
- 04Enterprise security teams must expand threat models to include supply chain vectors
Boston Scientific confirms cyberattack disrupting medical device shipments
The Massachusetts-based medical device manufacturer disclosed the incident in SEC filings Tuesday, warning of operational impact to its supply chain.
US sanctions Iranian nationals after UK power plant intrusion
Treasury action follows disclosure of cyber operation targeting British energy facility, marking coordinated transatlantic response to infrastructure threats.
Supply-chain attack embeds proxy botnet in Android car head units
Legitimate device-update app compromised to spread malware that turns in-vehicle systems into proxy nodes and ad-fraud platforms.