Amazon Threat Intelligence has, for the first time, tied a string of high-profile npm supply chain compromises, including September 2025’s hijack of the widely used debug and chalk packages, to a single North Korea-linked crew it tracks as Sapphire Sleet.
In research the company published July 29, 2026, Amazon assessed with medium confidence that the actor, also tracked as Stardust Chollima, BlueNoroff, CageyChameleon, and Alluring Pisces, was behind trojanized packages stretching from typo-crypto in March 2025 through debug and chalk in September 2025 to axios, which has more than 100 million weekly downloads, in March 2026. Amazon linked the campaigns through shared tactics: maintainer accounts compromised via social engineering, malicious code delivered through post-install hooks, multi-layer obfuscation, and payloads built to detect and avoid sandboxes. Debug and chalk combined for more than two billion weekly downloads, and Amazon’s post cites Wiz Research finding that roughly one in ten cloud environments were touched by that single event within a two-hour window.
Why it matters to the security leader: this is not just another poisoned package story, it is an attribution claim that reframes a year of scattered npm incidents as one adversary’s sustained campaign against the open source supply chain, with a demonstrated ability to compromise packages with billions of combined downloads through nothing more sophisticated than convincing a maintainer to hand over access. That changes the calculus for defense: watching for one-off malicious releases is not enough if a single, patient actor is rotating targets across the ecosystem.
Worth flagging: Amazon’s own post rates its confidence as medium, and no other vendor has independently named an actor for all three incident clusters, a reminder that attribution in supply chain cases often outruns the certainty of the underlying evidence, even when the technical link between campaigns is solid. Security teams should treat the TTP overlap, compromised maintainers, post-install hooks, obfuscated payloads, as the actionable signal regardless of whose name ends up on it. As CyberTech has reported, the ecosystem fix is shifting toward friction by default: registries delaying new package versions before they are trusted, rather than relying on defenders to catch each hijack individually.
Source: AWS Security Blog
