Amazon pins four npm compromises on N. Korean Sapphire Sleet

Amazon's security team has drawn a single throughline through four npm package compromises over the past 18 months, attributing the whole run with medium confidence to the North Korea-linked crew tracked as Sapphire Sleet, which is widely regarded as a Lazarus Group offshoot. According to The Register, the packages named in the research are typo-crypto, chalk, debug and Axios. Google had already tied the Axios incident to the same actor under its own name for the group, UNC1069; AWS is going further by bundling all four into a single operation on the strength of shared infrastructure and technical overlaps.

The tradecraft is the interesting part. Rather than exploiting zero-days or hacking npm itself, the crew allegedly took the slower route of befriending maintainers, stealing credentials, and publishing poisoned updates from accounts developers already trusted. That is a supply-chain attack shaped like a social one, and it sidesteps most of what the ecosystem has invested in around signing and registry hardening. If you trust the maintainer, you trust the release.

AWS CISO CJ Moses framed the AI angle in a way worth quoting directly. Attackers, he said, can now produce "thousands of lines of coherent, idiomatic, well-commented code, complete with convincing documentation, plausible commit histories, and synthetic maintainer identities, wrapped around a backdoor." And because "each variant can be mutated, renamed, restructured, and re-encrypted, there is no single stable signature to match." The upshot, per Moses, is that pattern-based detection loses ground against malware that looks one of a kind in every deployment.

The honest caveat is that this is Amazon's own research, published with medium confidence, and the reporting does not give you the downstream body count. How many organisations actually pulled a poisoned build of debug, chalk or Axios into production is not in the piece, and nor is a clean breakdown of how much of the observed malicious code was demonstrably AI-generated versus asserted as a broader trend.

What is worth watching from here is where defensive budget goes next. If the failure mode is a trusted maintainer's account rather than a broken registry, the vendors that benefit are the ones selling identity verification for publishers and behaviour-based scanning at install time, not another SBOM feed layered on top of the same signatures.