Summary
- Amazon Threat Intelligence says compromises of axios, debug, chalk, and typo-crypto share tactics, infrastructure, and code reuse.
- Amazon assesses with medium confidence that the campaigns are attributable to a DPRK-linked actor tracked under names including SAPPHIRE SLEET and BlueNoroff.
- The campaign shows how maintainer compromise and trusted updates can expose thousands of downstream development and cloud environments.
Amazon Web Services has linked several high-profile npm package compromises to the same Democratic People’s Republic of Korea-linked threat actor, connecting incidents affecting axios, debug, chalk, and typo-crypto into a broader open-source supply chain campaign.
Amazon Threat Intelligence said the actor compromised typo-crypto in March 2025, debug and chalk in September 2025, and axios in March 2026. In each case, the attacker gained access by socially engineering a trusted maintainer and then publishing a software update containing malicious code.
Amazon assesses with medium confidence that the campaigns are attributable to the actor tracked as SAPPHIRE SLEET, STARDUST CHOLLIMA, BlueNoroff, CageyChameleon, and Alluring Pisces. The axios compromise had already been publicly attributed to a North Korea-linked actor by Google Threat Intelligence Group. Amazon’s analysis connects that incident with earlier compromises that had not previously been publicly tied to the same actor.
The affected packages are common building blocks in modern software development. Axios is widely used for HTTP requests across JavaScript applications, while debug and chalk appear in many developer and server-side dependency trees. When a malicious version reaches an automatically resolved dependency chain, it may run in developer workstations, build systems, test environments, and production-adjacent services before a security team has direct evidence of impact.
The campaign also shows why open-source risk cannot be reduced to known vulnerabilities. The package itself may be trusted and widely used, while the maintainer account or release process has been compromised. Dependency scanning, software composition analysis, and version pinning help, but they do not fully address maintainer identity, package registry trust, build isolation, or secret exposure during installation.
Amazon described the activity as financially motivated and said compromising a small number of popular packages can create potential access to thousands of downstream environments at once. That pattern aligns with North Korea-linked operations where software supply chain access, developer environments, and cloud credentials can support cryptocurrency theft, espionage, or follow-on compromise.
UK and European organisations use npm packages across fintech, retail, public-sector services, SaaS products, and critical suppliers. A poisoned package can create exposure inside a supplier long before a customer receives any notice. Compromise may surface as leaked tokens, unauthorised cloud access, tampered builds, or data theft from systems that were not directly targeted by the original actor.
Response work should include checking whether compromised versions were present, reviewing dependency lockfiles, clearing caches, rotating exposed secrets, and isolating affected build hosts. Stronger controls include sandboxed builds, read-only credentials, restricted egress, internal package mirrors, provenance checks, and tighter maintainer account requirements.
