Amazon Links North Korea to Major npm Hijack That Went Unnoticed for 10 Months

Robert Moore · 2026-07-30

Amazon has officially tied the September 2025 hijack of two widely used npm packages, debug and chalk, to North Korea's Sapphire Sleet group. This revelation changes the narrative around an incident that, for ten months, was dismissed as a simple crypto theft. A maintainer was phished through a lookalike npm domain, and a wallet-draining script was pushed into at least 18 packages. These packages collectively carried more than 2 billion weekly downloads. The original reports from Aikido and Wiz did not attribute the attack to any state actor. ### What Actually Happened? The attack started when a maintainer of the popular npm packages debug and chalk was tricked into revealing their credentials. The phisher used a fake npm domain that looked almost identical to the real one. Once inside, they injected a malicious script designed to drain cryptocurrency wallets. The script was silently added to multiple package versions, affecting millions of developers who relied on these tools. For months, the security community treated it as a financially motivated attack. No one suspected a nation-state was behind it. ### Why This Matters for Developers This incident is a wake-up call for anyone using open-source software. The packages debug and chalk are foundational tools used in countless projects. If you work with JavaScript or Node.js, you've almost certainly used one of them. The attack shows that even the most trusted packages can become vectors for supply chain attacks. It also highlights how long such attacks can fly under the radar when they don't fit the expected pattern. ### The Role of Sapphire Sleet Sapphire Sleet is a known North Korean hacking group. They're infamous for targeting cryptocurrency exchanges and individual wallets. But this attack suggests they're expanding their methods. Instead of just stealing crypto directly, they're now compromising the tools that developers use to build software. This approach gives them access to a much larger pool of potential victims. It also makes detection harder because the malicious code is hidden inside legitimate software. ### What You Can Do to Protect Yourself - **Verify package integrity:** Always check the checksums of packages you download. Use tools like npm's integrity checking feature. - **Enable two-factor authentication:** This adds an extra layer of security to your npm account. Even if a phisher gets your password, they can't log in without the second factor. - **Monitor for unusual activity:** Watch for unexpected changes in your dependency trees. If a package you use suddenly updates with suspicious code, investigate immediately. - **Use a package lock file:** This ensures that you're using the exact versions of packages you've tested. It prevents malicious updates from being automatically installed. - **Stay informed:** Follow security advisories from trusted sources. The earlier you know about a vulnerability, the faster you can respond. ### The Bigger Picture This attack is a reminder that supply chain security is everyone's responsibility. Open-source software is built on trust, but trust alone isn't enough. Developers need to adopt security practices that make it harder for attackers to slip in unnoticed. Companies like Amazon, which rely heavily on open-source tools, are now taking a more active role in tracking down these threats. Their investigation into Sapphire Sleet shows that the industry is starting to treat these incidents with the seriousness they deserve. ### Final Thoughts The debug and chalk hijack is one of the most significant supply chain attacks in recent memory. The fact that it went undetected for nearly a year is alarming. But the silver lining is that it's forcing the security community to rethink how we protect open-source ecosystems. If you're a developer, take this as a lesson. Don't assume that popular packages are safe. Always stay vigilant, and make security a part of your daily workflow.