Amazon ties the chalk and debug npm hijacks to North Korean hackers

Amazon's threat intelligence team linked several major npm supply chain attacks to a North Korean group tracked as Sapphire Sleet, also known as BlueNoroff. The group compromised the small typo-crypto package in March 2025 as a test, then hijacked the hugely popular debug and chalk packages in September 2025, and axios in March 2026. The debug and chalk incident, which pushed a wallet-draining script into packages with billions of weekly downloads, reached roughly one in ten cloud environments within two hours. The attackers gained access by phishing package maintainers through lookalike npm domains, then published malicious versions that auto-installing projects pulled in.

Check

Review whether your projects or CI pulled compromised versions of typo-crypto, debug, chalk, or axios during the affected periods, and check developer and build environments for wallet-draining or credential-stealing behavior.

Affected

Developers and organizations that auto-install npm dependencies; a phished maintainer account can push a malicious version of a hugely popular package that reaches thousands of downstream environments within hours.

Fix

Pin and verify dependencies, add a delay before adopting new versions, watch for maintainer-account phishing, protect publishing accounts with phishing-resistant MFA, and monitor build environments for credential and wallet theft.