Suspected North Korean hackers have bugged a software package that has been used by thousands of US companies in a major supply-chain attack that could take months to recover from, security experts said Tuesday.

Experts who are responding to the hack told CNN they expect a long-term campaign to steal cryptocurrency to fund the North Korean regime, which often spends such stolen money on its nuclear and missile programs.

For three hours on Tuesday morning, the Pyongyang-linked hackers had access to the account of a software developer who manages the open-source software known as Axios. The hackers used that access to send malicious updates to any…