Amazon Attributes the Hijack of the npm Packages debug and chalk to North Korea's Sapphire Sleet

What happened

In September 2025 the npm packages debug and chalk were compromised. The maintainer was lured to a fake npm domain via phishing, after which the attackers pushed a script into at least 18 packages that swapped out cryptocurrency wallet addresses. Together these packages rack up more than 2 billion downloads a week. For ten months the incident was logged as an ordinary crypto heist: the initial reports from Aikido and Wiz named no one in particular.

On July 29, 2026, Amazon's Threat Intelligence unit stated with “medium confidence” that the attack was the work of the same group that breached the axios package in March 2026. Microsoft tracks it as Sapphire Sleet, Google as UNC1069; for both giants, the axios attribution appeared within two days. The breaches of debug, chalk, and the test package typo-crypto, by contrast, were assigned a “nationality” only ten and sixteen months later.

The evidence is thinner than the claim

Amazon points to a common modus operandi: trojanized packages, post-install hooks, code reuse, and overlapping command-and-control server indicators. But the company does not specify which particular piece of evidence links which incident. Meanwhile, the mechanics of the attacks differed: in debug and chalk a browser-based interceptor was at work, spoofing wallet APIs and leaving no traces on the system, whereas axios relied on an npm post-install hook.

The Hacker News journalists also examined typo-crypto itself. Version 4.3.0 of the package is still available in the registry, declares no install scripts, and its hashes match the registry records. Yet the single version was created and published 204 milliseconds apart on March 31, 2025, the publishing account does not match the listed author, and the description and keywords were copied from the crypto-js project. This looks more like a package built as a fake from the start than the “compromise of a maintainer followed by an update” that Amazon uses to describe all three campaigns. On top of that, the claimed hash of the core.js file did not turn up in any file in the archive.

“Old news”

Aikido, the firm that discovered the September attack, cooled Amazon's fervor: the DPRK connection, it says, has long been discussed in the community, and the hack itself is “classic DPRK” in method. Recall that the stakes were modest: according to Socket, the September wallets collected around 600 dollars.

The registry, meanwhile, is changing. npm version 12, released on July 8, disabled lifecycle scripts by default, and since July 28 npm has scanned new publications for malicious code before installation. But, as observers note, neither measure closes the main loophole — the compromise of a trusted maintainer.

Source: The Hacker News