'Generative AI is already changing what malicious software packages look like and how threat actors are beginning to probe AI-based code systems': Amazon flags North Korean hacker group as being behind the surge in open source supply chain attacks

North Korean flag with a hooded hacker.

• Amazon links multiple software supply chain attacks to one North Korean hacking group
• Generative AI enables convincing malware hidden inside trusted software packages at scale
• Attackers manipulated trusted maintainers before distributing compromised software updates to developers

Amazon has linked a North Korean threat actor to several recent compromises of popular NPM software libraries.