Amazon ties SapphireSleet to four npm supply-chain attacks
The debug, chalk, and axios compromises were one group operating across 12 months, not isolated incidents, and each hijack started with a maintainer, not a vulnerability.
TL;DR
Amazon's threat intelligence team linked North Korean group SapphireSleet to four compromises of widely-used JavaScript packages on npm: typo-crypto (March 2025), debug and chalk (September 2025), and axios (March 2026). The axios library alone sees over 100 million weekly downloads. In every case, the attackers socially engineered a trusted maintainer to gain publish access rather than exploiting a code vulnerability. Google and Microsoft had previously attributed the axios compromise to North Korea, but the earlier npm incidents hadn't been publicly connected to the same actor until now.
Amazon's report draws a single through-line across four npm compromises that, taken separately, looked like opportunistic hits. Together they reveal a campaign: same actor, same method, escalating targets over 12 months.
The group started small (typo-crypto, a package few would recognize) and worked upward. By September 2025 it had reached debug and chalk, tools embedded in developer workflows across the ecosystem. By March 2026 it compromised axios, a library that sits inside frontend frameworks, backend services, and enterprise applications at a scale that makes downstream enumeration nearly impossible.
What's new is the timeline, not the attribution
Google and Microsoft both attributed the axios compromise to North Korean actors within days of its disclosure. Google's Threat Intelligence Group tracks the group as UNC1069; Microsoft calls it Sapphire Sleet and notes overlap with BlueNoroff, Stardust Chollima, and others. Amazon's contribution is connecting the three earlier npm compromises to the same hands, a finding that recasts what looked like isolated supply-chain pokes as a systematic campaign.
The method is the same and it's not technical
In all four attacks, the entry point was social engineering of a package maintainer, not exploitation of a software flaw. Once the attacker held publish access, malicious updates rolled out through the normal dependency chain. Organizations that pulled the latest versions automatically (which is most of them) ingested the malware without any alarm at the package-manager level.
Amazon filed the malware under MAL-2026-3400 in the Open Source Vulnerabilities database. The payloads target credentials, cryptocurrency assets, and personal data, consistent with North Korea's established pattern of using cyber theft to generate revenue under sanctions. The regime stole over $2 billion in cryptocurrency in 2025 alone.
For practitioners, the takeaway is uncomfortable: the npm trust model assumes maintainer integrity, and when that fails (through a phishing lure, a fake job interview, or credential compromise) the entire downstream chain inherits the failure silently.
Published ·Deep Fathom
