Amazon Ties Sapphire Sleet to npm debug, chalk Hijack

Attribution confirmed. Amazon’s threat intelligence team has publicly tied the September 2025 hijacking of the npm packages debug and chalk to North Korea’s Sapphire Sleet — a state-sponsored financial crimes group also tracked as BlueNoroff and TA444. Reported by The Hacker News on July 30.

Timeline

September 2025. A debug package maintainer was phished via a lookalike npm domain. Attacker obtained push credentials. A wallet-draining payload was deployed across debug, chalk, and at least 16 additional npm packages in the dependency graph. Combined weekly downloads for the two flagship packages: more than 2 billion. Detection and initial disclosure: Aikido and Wiz. Attribution at that time: financially motivated crypto theft, actor unknown.

July 30, 2026. Amazon attributes the campaign to Sapphire Sleet. Confidence level: single-source (Amazon). Pending independent corroboration from a second government body or threat intelligence vendor — treat accordingly.

Sapphire Sleet

North Korean APT focused on financial theft. Documented operations include targeting cryptocurrency exchanges, DeFi platforms, and developer toolchains through credential-harvesting lures, fake recruitment offers, and malicious open-source packages. Previously tracked operations: Contagious Interview (fake npm packages used in developer recruitment lures) and numerous DeFi protocol compromises across multiple years. Independently attributed by Microsoft, Mandiant, and Recorded Future.

A phished npm maintainer credential resulting in a wallet-draining payload across high-download packages is consistent with this group’s documented playbook. The ten-month gap between initial disclosure and state attribution is also consistent — Sapphire Sleet operations frequently surface first as financially motivated intrusions before government-level attribution catches up.

What to check

If your project depends on debug or chalk and your package lock file reflects versions installed during the September 2025 window, audit your dependency history and build logs. Check for unauthorized outbound connections or unexplained wallet movements from systems that ran tainted builds during that period.

Remediation guidance is available through the npm security advisories page and the original Aikido and Wiz disclosures.

Related: 108 malicious npm packages traced to DPRK Contagious Interview · DPRK rollup-polyfill npm supply chain operation · joyfill npm packages deliver DEV#POPPER RAT