Amazon links four poisoned npm packages to one North Korean crew

Researchers say Sapphire Sleet socially engineered maintainers before publishing malicious updates through trusted accounts