Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet

Amazon Threat Intelligence has attributed the September 2025 hijack of the popular npm packages debug and chalk to North Korea’s Sapphire Sleet group, also tracked as UNC1069, STARDUST CHOLLIMA, BlueNoroff, Alluring Pisces, CageyChameleon, and CryptoCore. The incident, previously reported as crypto theft by Aikido and Wiz, involved a maintainer being phished through a lookalike npm domain, leading to a wallet-draining script pushed into at least 18 packages with over 2 billion weekly downloads.

Amazon’s research, published July 29, 2026, assesses with medium confidence that the same group behind the March 2026 axios compromise was responsible. The group also planted a trojanized file in a small package called typo-crypto in March 2025, which Amazon views as a test run. All three campaigns began by socially engineering a trusted maintainer and publishing a malicious update.

The evidence cited includes shared tradecraft, trojanized packages, post-install hooks, code reuse, and overlapping command-and-control indicators. However, Amazon remains the sole attribution source for the debug, chalk, and typo-crypto compromises, while axios was independently attributed by Google and Microsoft. The malicious file core.js in typo-crypto posed as the legitimate core-js package, triggering on a specific hash input and pulling a second stage from a hardcoded C2. Network indicators include npmjs[.]store and 216[.]74[.]123[.]126.

Notably, typo-crypto@4.3.0 remains published and installable as of July 30, 2026, with no install script. The package appears to have been built to impersonate crypto-js from its first publish, rather than being a compromised update. Amazon’s stated SHA256 hash for core.js does not match any file in the tarball, suggesting a possible mislabeling.

In response, npm shipped v12 on July 8, 2026, with dependency lifecycle scripts off by default, and began scanning new publishes for malware on July 28. However, these measures do not close the maintainer-compromise path.