North Korea behind the debug and chalk npm hijacks

Amazon Threat Intelligence published its attribution on July 30: the compromises of the debug, chalk, and axios npm packages were the same actor, a DPRK-linked group Amazon tracks as SAPPHIRE SLEET (also BlueNoroff, Stardust Chollima). Only the axios incident had been publicly tied to that group before. The other three campaigns were treated as unrelated one-offs. They weren't — and if you run a Node app, this npm supply chain story is your dependency tree, not somebody else's.

What actually happened

Per Amazon's write-up, the campaign runs back to March 2025 with typo-crypto — small scale, and Amazon reads it as a testing ground. It escalated in September 2025 with debug and chalk, which Amazon says reached roughly 1 in 10 cloud environments inside a two-hour window. In March 2026 the actor hit axios, a package with over 100 million weekly downloads. Amazon assigns the attribution with medium confidence, and connected the campaigns through shared tradecraft: maintainer social engineering, trojanized files, base64-plus-XOR obfuscation, and code reuse across incidents.

Two details are worth your attention. First, the delivery mechanism was post-install hooks — scripts npm runs automatically the moment a package lands, before you execute a single line of your own code. Second, The Record and Amazon both note the actor's newer techniques target AI-assisted development directly: slopsquatting (registering package names that LLMs hallucinate) and indirect prompt injection aimed at AI code reviewers.

Why npm supply chain risk matters for your business

You didn't install debug. Something you depend on did, four levels down, and a two-hour exposure window is shorter than most teams' time-to-notice. The payloads here were environment-aware — built to stay quiet in sandboxes and fire in real infrastructure.

Three things that actually reduce this. Turn off install scripts in CI: npm 12 already blocks them by default, so upgrade and stop overriding it. Put a delay between publish and adoption — Dependabot's three-day cooldown exists precisely because these windows are measured in hours. And commit your lockfile, then build from it, so a rebuild of last week's code pulls last week's bytes.

The AI angle deserves a hard rule: an agent that suggested a package name is not evidence the package exists, and an AI reviewer that read the diff is not a second pair of eyes. Verify the package on npm before it enters a manifest.

Sources: Amazon Web Services, The Record.