NewsPublished 30 Jul 2026

Amazon links Debug, Chalk NPM supply-chain attacks to North Korean hackers

Source Bleeping Computer

Description

Amazon linked multiple high-profile open-source software supply chain attacks targeting the Node Package Manager (npm) ecosystem to North Korean hackers. [...]

Impact

The supply chain attacks compromised widely used npm packages, including debug, chalk, and axios, potentially affecting a large number of downstream users and cloud environments. The malicious updates were automatically distributed, increasing the risk of widespread impact. The attacks enable indirect access to numerous victims through trusted packages, posing a significant risk to software supply chain integrity and security. The use of advanced evasion techniques complicates detection and mitigation efforts.

Defensive guidance

Amazon is actively collaborating with the open-source community and industry partners to address these threats. Security teams should monitor official advisories from npm, package maintainers, and security organizations for updates on patched versions or mitigations. Users should verify package integrity and maintain vigilance against suspicious package updates. No specific patches or fixes are detailed in the provided information.

Summary

Amazon attributed a series of supply chain compromises in the npm ecosystem to the North Korean threat actor Sapphire Sleet (also known as BlueNoroff and Stardust Chollima). Initial compromise started with the typo-crypto package in March 2025, followed by debug and chalk in September 2025, impacting approximately 10% of cloud environments within two hours. In March 2026, axios, a highly popular npm package, was targeted. The attacker used social engineering to gain maintainer access and pushed malicious updates that were automatically propagated to users. The attribution is of medium confidence based on shared TTPs and infrastructure. The campaign employed sophisticated evasion techniques including splitting malicious code, multi-stage encrypted payloads, environment-aware execution, and exploitation of AI-generated package name typosquatting. Amazon is responding by sharing intelligence, collaborating with OpenSSF and others, and funding the Akrites initiative to defend open-source software against AI-enabled supply chain threats.

References

bleepingcomputer.com/news/security/amazon-links-debug-chalk-npm-supply-chain-attacks-to-north-korean-hackers/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 30 Jul 2026, 18:22 UTC

References

Community reviews

Related threats