Amazon Attributes npm Package Hijack to North Korea's Sapphire Sleet
In September 2025, the npm packages 'debug' and 'chalk' were compromised through a phishing attack targeting a maintainer, leading to the injection of a wallet-draining script into at least 18 packages with over 2 billion weekly downloads. Initially, the incident was classified as a generic crypto theft. However, in July 2026, Amazon Threat Intelligence attributed this attack to North Korea's state-sponsored group, Sapphire Sleet, linking it to similar supply chain attacks on npm packages like 'axios' and 'typo-crypto'. This attribution underscores the persistent threat posed by state-sponsored actors targeting widely-used open-source software to conduct financially motivated cyber operations. The incident highlights the critical need for robust security measures in software supply chains to prevent such compromises.
Kill Chain
