Amazon Links npm Supply-Chain Attacks to North Korean Sapphire Sleet
Summary
Amazon linked compromises of typo-crypto, debug, chalk and axios to North Korean actor Sapphire Sleet with medium confidence, citing shared tactics, C2 infrastructure and operational similarities.
Key points
- Amazon attributed compromises involving typo-crypto, debug, chalk and axios to Sapphire Sleet, also known as BlueNoroff and Stardust Chollima; the attribution has medium confidence.
- Amazon says activity began with typo-crypto in March 2025, escalated to debug and chalk in September, and later included axios in March 2026.
- The debug and chalk compromises reportedly affected an estimated 10% of cloud environments within two hours.
- Amazon says attackers socially engineered package maintainers to publish malicious updates that were automatically distributed to users.
- Amazon highlighted evolving tactics including split malicious functionality, multi-stage payloads, environment-aware execution and slopsquatting using package names hallucinated by AI coding assistants.
- Amazon said it shared findings with the community, collaborated with OpenSSF and other partners, and invested $12.5 million in the Akrites initiative.
Article Details
- Event Type
- Amazon-attributed npm software supply-chain compromises
- Impact
- Malicious updates to typo-crypto, debug, chalk, and axios were reportedly distributed to users after package maintainers were socially engineered. Amazon estimated that the debug and chalk compromises affected 10% of cloud environments within two hours. Amazon assessed the attribution to Sapphire Sleet with medium confidence.
MITRE ATT&CK
Threat Actors
BlueNoroffAmazon identifies BlueNoroff as another name for Sapphire Sleet, which it linked to the npm package compromises with medium confidence.Sapphire SleetAmazon linked the npm package compromises to Sapphire Sleet with medium confidence, citing shared tactics, techniques, and procedures, command-and-control infrastructure, and operational similarities. Amazon identifies BlueNoroff and Stardust Chollima as names also used for this actor.STARDUST CHOLLIMAAmazon identifies Stardust Chollima as another name for Sapphire Sleet, which it linked to the npm package compromises with medium confidence.