Amazon Ties Debug and Chalk npm Hijack to North Korean Group, Citing Incomplete Evidence
Summary
Amazon Threat Intelligence links the September 2025 debug/chalk hijack to the group behind the axios compromise with medium confidence, but the article identifies gaps in the public evidence, including a typo-crypto package-history and hash mismatch.
Key points
- Amazon Threat Intelligence assessed with medium confidence that the group behind the March 2026 axios compromise was also behind the September 2025 debug and chalk hijack; earlier reports did not make that attribution.
- Amazon cites shared tradecraft, trojanized packages, code reuse, and overlapping command-and-control indicators, but does not specify which evidence links each incident. Amazon is the only attribution source cited for debug, chalk, and typo-crypto.
- The debug and chalk payload reportedly intercepted browser requests and wallet APIs to alter transaction addresses before signing; it did not leave persistence on the machine.
- Amazon characterizes typo-crypto as a test run. Registry history shows one version published without an earlier version to update, and its author account does not match the named developer; the record does not establish how the account was obtained.
- The typo-crypto file reportedly contains Amazon’s cited trigger and XOR key, but Amazon’s stated core.js hash does not appear in the published package tarball; the article says the discrepancy is unexplained.
- npm v12 disables dependency lifecycle scripts by default, removing the default post-install path used by axios, but does not prevent maintainer compromise. npm’s malware scan applies to newly published packages, not existing registry packages.
Article Details
- Attack Vectors
- Amazon says the campaigns began by socially engineering trusted package maintainers and then publishing package updates; Aikido and Wiz reported that the debug and chalk maintainer was phished through a lookalike npm domain.
- The debug and chalk packages contained a browser-side interceptor that hooked fetch, XMLHttpRequest, and wallet APIs to rewrite transaction addresses before users signed.
- Amazon says the typo-crypto package contained a trojanized core.js file that waited for a hash input beginning 0098273, then retrieved an operating-system-specific second stage from a hardcoded C2.
- The axios compromise used an npm post-install hook, according to the article; Amazon says the debug and chalk and typo-crypto payloads did not depend on that hook.
- Defensive Notes
- npm v12 disables dependency lifecycle scripts by default, removing the default post-install path used in the axios compromise; the article notes this does not prevent maintainer compromise.
- Since July 28, npm has scanned newly published packages for malware before they become installable. The scanning does not apply to packages already on the registry.
- npm v12 lifecycle-script blocking and OIDC do not close the maintainer-compromise entry point, according to Sarah Gooding's commentary cited in the article.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | npmjs[.]store | Reported hardcoded command-and-control domain used to retrieve the second-stage payload. |
| IPV4 | 216[.]74[.]123[.]126 | Reported command-and-control IP address associated with the second-stage payload. |
MITRE ATT&CK
T1105 · Ingress Tool TransferThe typo-crypto core.js file retrieved an operating-system-specific second stage from a hardcoded C2.T1195.002 · Compromise Software Supply ChainThe reported activity involved trojanized npm packages and malicious package updates, including debug, chalk, axios, and typo-crypto.T1566 · PhishingAikido and Wiz reported that the debug and chalk maintainer was phished through a lookalike npm domain.
People
Threat Actors
BlueNoroffMicrosoft said Sapphire Sleet overlaps with activity tracked as BlueNoroff; Amazon assessed with medium confidence that the group behind axios was also behind the debug, chalk, and typo-crypto activity.CageyChameleonMicrosoft said Sapphire Sleet overlaps with activity tracked as CageyChameleon; Amazon assessed with medium confidence that the group behind axios was also behind the debug, chalk, and typo-crypto activity.Sapphire SleetMicrosoft attributed the axios compromise to Sapphire Sleet. Amazon assessed with medium confidence that the group behind axios was also behind the debug, chalk, and typo-crypto activity.STARDUST CHOLLIMAMicrosoft said Sapphire Sleet overlaps with activity tracked as STARDUST CHOLLIMA; Amazon assessed with medium confidence that the group behind axios was also behind the debug, chalk, and typo-crypto activity.UNC1069Google attributed the axios compromise to UNC1069; Microsoft said Sapphire Sleet overlaps with activity tracked as UNC1069. Amazon assessed with medium confidence that the group behind axios was also behind the debug, chalk, and typo-crypto activity.
Malware
Products
AxiosAmazon Threat Intelligence says the September 2025 hijack of debug and chalk was linked to a North Korean group, connecting it to earlier activity involving typo-crypto and the March 2026 axios compromise.ChalkAmazon Threat Intelligence says the September 2025 hijack of debug and chalk was linked to a North Korean group, connecting it to earlier activity involving typo-crypto and the March 2026 axios compromise.core-jsThe malicious file Amazon describes, core.js, posed as the legitimate core-js package inside the repository.crypto-jsIts description and keywords are copied from crypto-js, at a version one release ahead of crypto-js’s own latest, 4.2.0.DebugAmazon Threat Intelligence says the September 2025 hijack of debug and chalk was linked to a North Korean group, connecting it to earlier activity involving typo-crypto and the March 2026 axios compromise.npmnpm v12 and malware scanning reduce risk, but do not stop maintainer compromise.typo-cryptoAmazon Threat Intelligence says the September 2025 hijack of debug and chalk was linked to a North Korean group, connecting it to earlier activity involving typo-crypto and the March 2026 axios compromise.