Amazon Ties Four NPM Attacks to DPRK's SAPPHIRE SLEET
The same playbook (socially engineer a maintainer, publish a trojanized update) links axios, debug, chalk, and typo-crypto compromises across a year-long campaign, Amazon Threat Intelligence found.
TL;DR
Amazon Threat Intelligence has attributed four high-profile NPM package compromises (axios, debug, chalk, and typo-crypto) to the same DPRK-linked group, SAPPHIRE SLEET, in a finding made public for the first time. Each followed an identical playbook: social-engineer a trusted maintainer, publish a trojanized update with a post-install hook. The campaign stretched from March 2025 to March 2026. Axios, downloaded over 100 million times weekly, was the most recent target. Amazon assessed the attribution at medium confidence based on shared command-and-control infrastructure and code reuse.
The operational signature
The four compromises share a clean playbook. In each case, the attacker gained access by socially engineering a package maintainer, not by exploiting a code vulnerability or stealing a token through malware. Once inside, they published a version update containing a post-install script, the NPM mechanism that runs arbitrary code whenever a package is installed or updated. Organizations that pulled the latest version automatically (standard practice in many CI/CD pipelines) got the malicious code. No zero-day required. Amazon's threat researchers found shared command-and-control infrastructure and code reuse across all four incidents, which is what ties them to a single operator.
A patient campaign
The financial logic is efficient. Axios alone sees over 100 million weekly downloads. Compromise that one package and you've got potential footholds in a significant fraction of the JavaScript ecosystem. The campaign's year-long span (typo-crypto in March 2025, debug and chalk in September 2025, axios in March 2026) suggests a patient operator, not a smash-and-grab. Amazon assesses medium confidence in the attribution. That's a reasonable qualifier: the TTP overlap is specific enough to be persuasive but not so distinctive as to rule out a well-resourced copycat. The axios compromise was already publicly attributed to DPRK; the debug, chalk, and typo-crypto linkages are new.
What changes Monday
For practitioners the takeaway is blunt. Post-install scripts are the attack surface. If your build pipeline pulls latest versions automatically, you're running whatever code the maintainer (or whoever owns the maintainer's account) published this morning. Pinning dependency versions to known-good releases eliminates that exposure. Audit package-lock.json for compromised versions of these four packages. Amazon's advisory recommends rotating credentials if any made it into your environment; the post-install payloads were designed to exfiltrate secrets. Mandating phishing-resistant MFA for all maintainer accounts on your critical dependencies isn't a bad idea either, though that's a procurement conversation, not a patch.
Published ·Deep Fathom
