Amazon pins four npm compromises on N. Korean Sapphire Sleet
TL;DR
- Amazon publicly linked typo-crypto, debug, chalk, and axios to a single Sapphire Sleet campaign for the first time, with medium confidence based on shared C2 infrastructure and TTPs.
- Debug and chalk's September 2025 poisoning hit roughly 1 in 10 cloud environments within two hours of malicious publication, before most security teams could respond.
- Typo-crypto in March 2025 served as a proving ground: Sapphire Sleet refined multi-layer obfuscation for a full year before escalating to packages with 100M+ weekly downloads.
Amazon's security team has drawn a single throughline through four npm package compromises over the past 18 months, attributing the whole run with medium confidence to the North Korea-linked crew tracked as Sapphire Sleet, which is widely regarded as a Lazarus Group offshoot. According to The Register, the packages named in the research are typo-crypto, chalk, debug and Axios. Google had already tied the Axios incident to the same actor under its own name for the group, UNC1069; AWS is going further by bundling all four into a single operation on the strength of shared infrastructure and technical overlaps.
The tradecraft is the interesting part. Rather than exploiting zero-days or hacking npm itself, the crew allegedly took the slower route of befriending maintainers, stealing credentials, and publishing poisoned updates from accounts developers already trusted. That is a supply-chain attack shaped like a social one, and it sidesteps most of what the ecosystem has invested in around signing and registry hardening. If you trust the maintainer, you trust the release.
AWS CISO CJ Moses framed the AI angle in a way worth quoting directly. Attackers, he said, can now produce "thousands of lines of coherent, idiomatic, well-commented code, complete with convincing documentation, plausible commit histories, and synthetic maintainer identities, wrapped around a backdoor." And because "each variant can be mutated, renamed, restructured, and re-encrypted, there is no single stable signature to match." The upshot, per Moses, is that pattern-based detection loses ground against malware that looks one of a kind in every deployment.
The attribution comes from Amazon itself, published with medium confidence, and the reporting does not give you the downstream body count. How many organisations actually pulled a poisoned build of debug, chalk or Axios into production is not in the piece, and nor is a clean breakdown of how much of the observed malicious code was demonstrably AI-generated versus asserted as a broader trend.
What is worth watching from here is where defensive budget goes next. If the failure mode is a trusted maintainer's account rather than a broken registry, the vendors that benefit are the ones selling identity verification for publishers and behaviour-based scanning at install time, not another SBOM feed layered on top of the same signatures.
What others are reporting
-
AWS Security Blog Read →
First-party source with the full technical timeline; reveals the typo-crypto XOR cipher keyed to 01042025 and OS-specific payload delivery details not in secondary coverage.
roughly 1 in 10 cloud environments were affected by the debug and chalk supply chain event within a two-hour window.
-
BleepingComputer Read →
Detailed tradecraft breakdown: AI-enhanced social engineering, multi-stage payloads with runtime encryption, and environment-aware malware designed to evade sandboxes.
Attacker gained access by socially engineering package maintainers, then published malicious updates automatically distributed to unsuspecting users.
-
The Hacker News Read →
Only outlet to critically examine Amazon's evidence gaps, including a SHA256 hash mismatch in the published IOCs and the tradecraft split between campaigns.
The same group planted a trojanized file in a small package called typo-crypto in March 2025, a full year before it reached axios.
-
Infosecurity Magazine Read →
Adds slopsquatting context: Sapphire Sleet is also targeting AI-hallucinated package names, broadening the attack surface beyond compromised legitimate maintainers.
By compromising a small number of highly popular packages, the group gains potential access to thousands of downstream environments simultaneously.
-
The Stack Read →
Frames typo-crypto explicitly as a low-risk testing ground where Sapphire Sleet stress-tested obfuscation before pivoting to ecosystem-critical targets.
Originally reported by theregister.com
Read the original article →Original headline: Amazon Ties 18 Months of Poisoned npm Packages, Including Axios, Chalk and Debug, to N. Korean Sapphire Sleet