Amazon has attributed the September 2025 hijacking of popular npm packages 'debug' and 'chalk' to North Korea's Sapphire Sleet threat group. The attack, which remained unattributed for ten months, involved phishing a maintainer through a lookalike npm domain and deploying wallet-draining scripts across at least 18 packages with over 2 billion combined weekly downloads.
Amazon has tied the September 2025 hijack of the npm packages debug and chalk to North Korea. For ten months, the incident sat in the public record as crypto theft: a maintainer phished through a lookalike npm domain and a wallet-draining script pushed into at least 18 packages carrying more than 2 billion weekly downloads between them. The original Aikido and Wiz reports did not attribute the
Originally published at thehackernews.com
60-minute technical evaluation, no obligation. We'll map the ideas in this article to your environment.
1 min read
1 min read
1 min read