Amazon unmasks North Korean hackers using AI to attack open source supply chain

Amazon identifies North Korean hacker group behind attacks on the open source supply chain

Amazon Web Services (AWS) announced that they discovered a group of North Korean hackers, known as Lazarus, orchestrating attacks aimed at the open source software supply chain. The invaders are creating malicious packages that disguise themselves to escape sandboxes and analytics environments, using advanced techniques that include the use of generative AI to automate the creation of misleading code.

Generating IA and malicious packages: how do they cheat sandwiches?

North Korean hackers have developed Python and JavaScript packages that appear to be legitimate libraries, but contain hidden code designed to extract credentials and sensitive data. Amazon found that attackers use a method called "backdooring" – they modify popular repositories in GitHub and npm, inserting payloads that are only activated when the security sandbox is not present. Generating AI is used to automatically and quickly generate variations in malicious code, making detection by traditional signatures difficult.

Why do open source chain AI attacks matter in Brazil?

Brazil is one of the largest open source consumers in the world, with thousands of companies and startups depending on public libraries to accelerate development. A committed package can infect a whole chain, from small applications to critical systems of large corporations. Amazon warns developers using unchecked source packages or ignoring integrity verification are more vulnerable. The company recommends using tools such as pip audit and analyzing dependencies with automated scanners.

Does the generative reshape cyber attacks and defenses?

Yeah. While hackers use AI to generate malicious code undetectable by static signatures, Amazon invests in machine learning models that analyze package behavior patterns – such as abnormal network calls or unexpected modifications in the file system – to block real-time threats. The company claims that the arms race between offensive and defensive AI is intensifying, and that keeping the open source ecosystem safe requires collaboration between maintainers and cloud platforms.

What does Amazon do to protect open source maintainers?

AWS has launched new free tools for open source project maintainers, including automated security analyses on CI/CD pipelines and alerts on vulnerable dependencies. In addition, the company is expanding its bug reward program to specifically cover attacks on the supply chain. The initiative is part of a larger effort, which includes participation in alliances such as the Open Secure AI Alliance led by NVIDIA, which aims to create standards for security in AI and open source.

> For more technical details, see the official AWS blog: Amazon Identifies North Korean hacker group behind open-source supply chain attacks.

Frequently Asked Questions about Generating AI and North Korean hackers

What are supply chain open source attacks?

These are attacks in which an intruder inserts malicious code into widely used open source libraries or packages, so that when developers download and execute them, the harmful code spreads across various systems and organizations.

How can I protect my project from malicious packages?

Use only official repository sources, enable two-factor authentication to maintain repositories, check integrity hashes with sha256sum and consider software composition analysis (SCA) tools such as snyk or dependabot.

Will the generative AI make the attacks more frequent?

Yes, because AI automates the creation of malware variants and the elaboration of packages that perfectly mimic legitimate projects, increasing the speed and scale of attacks. However, AI-based defenses also evolve, creating a scenario of constant adaptation.