Amazon Attributes npm Package Hijack to North Korea's Sapphire Sleet
Executive Summary
In September 2025, the npm packages 'debug' and 'chalk' were compromised through a phishing attack targeting a maintainer, leading to the injection of a wallet-draining script into at least 18 packages with over 2 billion weekly downloads. Initially, the incident was classified as a generic crypto theft. However, in July 2026, Amazon Threat Intelligence attributed this attack to North Korea's state-sponsored group, Sapphire Sleet, linking it to similar supply chain attacks on npm packages like 'axios' and 'typo-crypto'.
This attribution underscores the persistent threat posed by state-sponsored actors targeting widely-used open-source software to conduct financially motivated cyber operations. The incident highlights the critical need for robust security measures in software supply chains to prevent such compromises.
Why This Matters Now
The recent attribution of the 'debug' and 'chalk' npm package hijack to North Korea's Sapphire Sleet emphasizes the ongoing risk of supply chain attacks in open-source ecosystems. Organizations must prioritize securing their software supply chains to mitigate potential threats from state-sponsored actors.
Attack Path Analysis
In September 2025, North Korea's Sapphire Sleet compromised the npm packages 'debug' and 'chalk' by phishing a maintainer through a lookalike npm domain, leading to the insertion of a wallet-draining script into at least 18 packages with over 2 billion weekly downloads. The attackers escalated privileges by leveraging the compromised maintainer's credentials to publish malicious updates. They then moved laterally by distributing the malicious packages to a vast number of developers and CI/CD pipelines. Command and control were established through the malicious code, allowing the attackers to execute commands remotely. Exfiltration occurred as the wallet-draining script intercepted and redirected cryptocurrency transactions. The impact was significant, resulting in financial losses and potential reputational damage to the affected packages and their users.
Kill Chain Progression
Initial Compromise
Description
Sapphire Sleet phished a maintainer using a lookalike npm domain to gain access to the 'debug' and 'chalk' packages.
MITRE ATT&CK® Techniques
Spearphishing Link
User Execution: Malicious Library
Supply Chain Compromise: Compromise Software Supply Chain
Resource Hijacking: Compute Hijacking
Event Triggered Execution: Installer Packages
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure the integrity of software and scripts
Control ID: 6.3.2
NYDFS 23 NYCRR 500 – Application Security
Control ID: 500.08
DORA – ICT Risk Management Framework
Control ID: Article 6
CISA ZTMM 2.0 – Data Security
Control ID: Pillar 3: Data
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Direct exposure to npm supply chain attacks targeting development dependencies; requires enhanced package validation, zero trust segmentation for development environments.
Financial Services
High risk from compromised development tools enabling cryptocurrency theft; needs egress security controls and encrypted traffic monitoring for transaction protection.
Information Technology/IT
Critical vulnerability through widespread npm package usage in client systems; demands multicloud visibility, threat detection capabilities, and secure development practices.
Computer/Network Security
Professional reputation impact from supply chain compromise affecting security tools; requires advanced anomaly detection and east-west traffic security implementation.
Sources
- Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleethttps://thehackernews.com/2026/07/amazon-links-debug-and-chalk-npm-hijack.htmlVerified
- npm debug and chalk packages compromisedhttps://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromisedVerified
- Widespread npm Supply Chain Attack: Breaking Down Impact & Scope Across Debug, Chalk, and Beyondhttps://www.wiz.io/blog/widespread-npm-supply-chain-attack-breaking-down-impact-scope-across-debug-chalkVerified
- npm debug / chalk Supply-Chain Attack: The Complete Guidehttps://cycode.com/blog/npm-debug-chalk-supply-chain-attack-the-complete-guide/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could have constrained the attacker's ability to escalate privileges, move laterally, and exfiltrate data by enforcing strict segmentation and identity-aware policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: While Aviatrix CNSF may not prevent initial credential compromise, it could limit the attacker's ability to exploit compromised credentials to access other workloads.
Control: Zero Trust Segmentation
Mitigation: Aviatrix Zero Trust Segmentation could likely limit the attacker's ability to escalate privileges by restricting access to critical systems and resources.
Control: East-West Traffic Security
Mitigation: Aviatrix East-West Traffic Security could likely constrain lateral movement by monitoring and controlling internal traffic flows.
Control: Multicloud Visibility & Control
Mitigation: Aviatrix Multicloud Visibility & Control could likely detect and limit unauthorized command and control channels.
Control: Egress Security & Policy Enforcement
Mitigation: Aviatrix Egress Security & Policy Enforcement could likely limit data exfiltration by controlling outbound traffic.
While Aviatrix CNSF may not prevent all impacts, it could likely reduce the scope of financial losses and reputational damage by containing the attack and limiting its reach.
Impact at a Glance
Affected Business Functions
- Software Development
- Web Application Deployment
- Cryptocurrency Transactions
Estimated downtime: 2 days
Estimated loss: N/A
Potential exposure of cryptocurrency transaction data due to malicious code intercepting and redirecting transactions.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict access and limit the spread of malicious code.
- • Enforce Egress Security & Policy Enforcement to monitor and control outbound traffic, preventing unauthorized data exfiltration.
- • Utilize Threat Detection & Anomaly Response to identify and respond to unusual activities promptly.
- • Apply Inline IPS (Suricata) to detect and prevent known exploit patterns and malicious payloads.
- • Ensure Multicloud Visibility & Control to maintain comprehensive oversight across all cloud environments.
