The International Institute for Security Studies has the story.

North Korea’s missile programme has made astounding strides over the past two years. An arsenal that had been based on short- and medium-range missiles along with an intermediate-range Musudan that repeatedly failed flight tests, has suddenly been supplemented by two new missiles: the intermediate-range Hwasong-12 and the intercontinental ballistic missile (ICBM), Hwasong-14. No other country has transitioned from a medium-range capability to an ICBM in such a short time. What explains this rapid progression? The answer is simple. North Korea has acquired a high-performance liquid-propellant engine (LPE) from a foreign source.

Available evidence clearly indicates that the LPE is based on the Soviet RD-250 family of engines, and has been modified to operate as the boosting force for the Hwasong-12 and -14. An unknown number of these engines were probably acquired though illicit channels operating in Russia and/or Ukraine. North Korea’s need for an alternative to the failing Musudan and the recent appearance of the RD-250 engine along with other evidence, suggests the transfers occurred within the past two years.

These engines could have come from Ukraine or from Russia; however, Oleksandr Turchynov, Secretary of Ukraine’s Security and Defense Council, denies that Ukraine was the source.

Ukraine has never supplied rocket engines or any kind of missile technology to North Korea.

There’s no reason to doubt the Ukrainian denials.  The rocket engines were manufactured in Ukraine (in addition to then-Soviet Russia) and so the Ukrainians would have access to the technology, certainly, and they could have had some leftover engines.  But the development work was done in Soviet Russia’s defense facilities; Russia today also has that technology (although they’ve moved beyond it), and manufacturing facilities, and Russia has an interest in exacerbating the northern Korean threat to our allies and to us.  Too, any such engines remaining in Ukraine likely would have been transferred to Russia along with Ukraine’s nuclear missiles under the Budapest Memorandum.

The IISS speculates that disgruntled Ukrainian engineers, in the extremity of the economic dislocation from Russia’s invasion and partition of Ukraine, could have done the transfer.  That seems unlikely, too, though: getting the engines out of Ukraine would have been much dicier than getting them out of Russia—which has a border with northern Korea.  There’s also little reason to suspect that only the technology was transferred; northern Korea hasn’t demonstrated the manufacturing facility for building RD-250s.

There is some less unfavorable news associated with this.  Being liquid fueled, northern Korea’s ICBMs would have to be fueled just before launch; that generally gives considerable warning that a launch (or launches) is imminent and so associated responses would have time to be prepared.