Amazon Threat Intelligence has assessed with medium confidence that North Korea’s Sapphire Sleet, a state-sponsored threat group tracked as UNC1069, STARDUST CHOLLIMA, and BlueNoroff, was behind the September 2025 hijack of the npm packages debug and chalk. The attribution links four packages across three campaigns in twelve months, connecting incidents that security firms had previously characterized as unrelated financially motivated cryptocurrency theft operations.
Amazon’s Attribution Spans Four Packages Across Three Campaigns
Security researchers at Aikido and Wiz had documented the debug and chalk hijacking as a crypto wallet-draining scheme. The malicious versions deployed a browser-side interceptor that hooked fetch, XMLHttpRequest, and wallet API calls to rewrite cryptocurrency transaction addresses before user signing, leaving no persistence on the endpoint. Amazon’s analysis now places those incidents alongside the March 2026 compromise of axios, which Google and Microsoft had independently tied to the same North Korean cluster, and an earlier test-run package, typo-crypto, published in March 2025.
The Browser-Side Interceptor Technique Used in Debug and Chalk
The payload in the compromised debug and chalk packages operated entirely within the browser runtime. By intercepting fetch, XMLHttpRequest, and wallet API calls, it could alter transaction destination addresses immediately before the user signed the transaction. The design required no persistent system modification and left no forensic artifacts on the compromised machine. Security researchers have described this technique as consistent with North Korean cryptocurrency theft operations, which increasingly favor single-use, in-memory payloads that evade traditional endpoint detection.
The Typo-Crypto Package as an Earlier Reconnaissance Operation
Amazon’s evidence also covers typo-crypto version 4.3.0, published March 31, 2025, designed from its first publish to impersonate the legitimate crypto-js library. Unlike the debug and chalk incidents, which involved compromising a trusted maintainer’s account, typo-crypto was a typo-squatting package created to deceive developers who mistyped the library name. This earlier operation likely served as a proof of concept before the group escalated to the more technically sophisticated maintainer-compromise technique used in the subsequent campaigns.
Attribution Strength and Independent Corroboration
Amazon’s evidence is strongest for the axios compromise, where both Google and Microsoft issued independent assessments tying the incident to Sapphire Sleet. For the debug, chalk, and typo-crypto incidents, Amazon remains the sole attribution source, and the assessment carries medium confidence. The difficulty of attributing supply chain attacks through compromised maintainer accounts, where the adversary operates behind a legitimate developer’s identity and credentials, makes corroboration inherently challenging.
Sapphire Sleet’s Social Engineering Pattern Across Four npm Packages
The pattern across all four packages — social engineering a trusted maintainer, then publishing a malicious update — reflects a tradecraft investment more characteristic of state-sponsored groups than financially motivated cybercriminals. The campaigns demonstrate that North Korean operators have acquired the operational security and social engineering skills necessary to compromise high-profile open-source maintainers and inject malicious code into packages with millions of weekly downloads. Security practitioners have noted that this approach gives state actors access to downstream networks that would be difficult to achieve through direct intrusion.
Defensive Improvements in the npm Ecosystem
The npm ecosystem has been strengthening defenses in response to the growing frequency of supply chain attacks. Version 12 of npm, released July 8, ships with dependency lifecycle scripts disabled by default, a change that blocks entire classes of post-install payloads. On July 28, npm began scanning all new publishes for malware, adding a preventive detection layer. These improvements directly target attack vectors that the Sapphire Sleet campaign and similar operations have exploited. For end users of the affected packages, no active response is required beyond standard dependency hygiene and monitoring for unexpected behavior in applications using debug, chalk, or their transitive dependencies.
Broader Implications for Open Source Supply Chain Defense
The Sapphire Sleet campaign illustrates a structural vulnerability in the open-source ecosystem: a motivated state-sponsored group can compromise a single maintainer account and gain the trust of millions of downstream users. The social engineering vector has proven effective across multiple incidents and does not require exploiting a technical vulnerability in the package registry or build tooling. For organizations consuming open-source dependencies, the incident reinforces the case for treating high-profile packages as critical infrastructure, with corresponding investment in dependency review, integrity verification, and incident response planning for supply chain compromises.
