Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet
Summary: Amazon Threat Intelligence published research on July 29 assessing with medium confidence that the group behind the March 2026 axios compromise also carried out the September 2025 hijack of the npm packages debug and chalk, which together carried more than 2 billion weekly downloads. Amazon also tied a March 2025 trojanized file in the small package typo-crypto to the same group, reading it as a test run, while noting the evidence it published cites shared tradecraft and overlapping command-and-control indicators without saying which evidence ties which incident.
Bottom line: The registry record for typo-crypto@4.3.0 shows a single version created and published 204 milliseconds apart on March 31, 2025, from an account that does not match the package's named author, with description and keywords copied from crypto-js - a record that fits a package built to impersonate another project from its first publish, not the maintainer compromise Amazon describes. The package was still published and installable when The Hacker News checked the registry on July 30, 2026, and npm's July 28 malware scanning applies only to new publishes, not to packages already on the registry.
Read the original at The Hacker News ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026