North Korean Hackers Behind Major npm Supply Chain Attack

In a significant development in open-source software security, Amazon has officially attributed the 2025 hijacking of widely-used npm packages 'debug' and 'chalk' to North Korea's advanced persistent threat group, Sapphire Sleet. The breach, which initially appeared as a cryptocurrency theft scheme, exploited developer trust through domain spoofing and remained undetected for nearly ten months.

The compromised packages, downloaded over 2 billion times per week collectively, were altered to include malicious scripts designed to drain cryptocurrency wallets. This supply chain attack underscores the growing sophistication of state-sponsored adversaries targeting software development ecosystems.

Attack Vector and Timeline

• Sapphire Sleet created lookalike domains mimicking legitimate npm infrastructure to deceive package maintainers.
• Phishing techniques were used to gain access to maintainer accounts and inject malicious code into package updates.
• At least 18 npm packages were compromised between September 2025 and mid-2026.
• Malicious payloads included scripts specifically designed to steal cryptocurrency from developers' wallets.
• The campaign went unnoticed for approximately ten months before full attribution was completed.

Impact and Defensive Recommendations

• Affected packages had a combined reach of over 2 billion weekly downloads across global software projects.
• Organizations relying on JavaScript/npm dependencies should audit their supply chains for suspicious package versions.
• Developers are advised to enable two-factor authentication and monitor for unusual activity in package management accounts.
• Use of software composition analysis tools can help detect unauthorized or unexpected dependencies.
• Security teams should consider implementing allow-lists for trusted package repositories and enforce code-signing policies.

Sources

• Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet