Amazon Links Debug and Chalk NPM Supply Chain Attacks to North Korean State Hackers

Amazon Threat Intelligence attributed four npm supply-chain compromises to a single DPRK-linked threat actor tracked as Sapphire Sleet, also known as Stardust Chollima, BlueNoroff, CageyChameleon and Alluring Pisces 1. The group trojanized the typo-crypto package in March 2025, then compromised the widely used debug and chalk packages in September 2025, an event Wiz Research found affected roughly one in ten cloud environments within a two-hour window 12. In March 2026 the same operational playbook appeared in a compromise of axios, a JavaScript library with more than 100 million weekly downloads that Google and Microsoft had already tied to North Korean actors; Amazon says the axios incident had not previously been linked to the earlier package compromises 13. Amazon assesses the attribution with medium confidence based on shared tactics, techniques, procedures and command-and-control infrastructure, and says the attacker gained access in each case by socially engineering a trusted package maintainer before publishing a malicious update 14.