Amazon has linked several major npm supply-chain attacks to Sapphire Sleet, a North Korean threat actor also known as BlueNoroff and Stardust Chollima.
The campaign targeted popular open-source JavaScript packages, including typo-crypto, debug, chalk and axios. Amazon said the attackers used social engineering to compromise package maintainers, then pushed malicious updates to downstream users.
Popular NPM packages were compromised
Amazon believes the activity began in March 2025 with the trojanisation of typo-crypto. Researchers said the package likely served as a testing ground before the attackers moved on to more widely used libraries.
The campaign escalated in September 2025 when the attackers compromised debug and chalk. Amazon estimated that those incidents affected around 10% of cloud environments within two hours.
In March 2026, the group also targeted axios, one of npm’s most widely used packages. Axios receives more than 100 million weekly downloads.
The axios compromise had already been publicly attributed to North Korean-linked actors. However, Amazon now connects it to the earlier package attacks.
Amazon attributes campaign to Sapphire Sleet
Amazon attributed the npm supply-chain attacks to Sapphire Sleet with medium confidence.
The assessment is based on shared tactics, techniques and procedures, command-and-control infrastructure and operational similarities across the incidents.
Researchers believe the campaign was financially motivated. By targeting trusted and widely used libraries, the attackers could gain indirect access to a large number of potential victims at once.
Attackers build trust before inserting malicious code
Amazon highlighted several trends that make recent software supply-chain attacks harder to detect.
Threat actors are increasingly spending months building trust. They may maintain legitimate projects or become contributors before inserting malicious code.
Attackers are also splitting harmful functionality across several packages that appear benign in isolation. This makes it more difficult for automated tools and human reviewers to spot the full attack chain.
In some cases, the malicious behaviour is no longer stored directly in the package. Instead, it relies on external scripts, configuration files or servers that can be weaponised later.
AI-assisted tactics complicate analysis
Attackers are using stronger encryption, multi-stage payloads and remotely retrieved keys to make static analysis more difficult.
Malware is also becoming more environment-aware. It may delay execution until it detects a real developer or production environment, helping it avoid sandbox analysis.
Amazon also warned about “slopsquatting.” This involves registering package names that AI coding assistants mistakenly invent, in the hope that developers or autonomous coding agents will install them.
AI can help attackers produce malicious code, documentation and convincing maintainer identities more quickly. As a result, the barrier to launching supply-chain attacks is becoming lower.
Amazon expands open-source security efforts
Amazon said it has shared its findings with the wider security community and is working with OpenSSF and other industry partners.
The company is also investing $12.5 million in the Akrites initiative, which aims to protect critical open-source software from AI-enabled threats.
The incidents show why development teams should carefully verify package names, use dependency controls and monitor updates from trusted libraries. A compromised package can expose a large number of organisations within hours.
0 responses to “Amazon Links Debug and Chalk NPM Supply-Chain Attacks to North Korean Hackers”