Amazon attributed a series of supply chain compromises in the npm ecosystem to the North Korean threat actor Sapphire Sleet (also known as BlueNoroff and Stardust Chollima). Initial compromise started with the typo-crypto package in March 2025, followed by debug and chalk in September 2025, impacting approximately 10% of cloud environments within two hours. In March 2026, axios, a highly popular npm package, was targeted. The attacker used social engineering to gain maintainer access and pushed malicious updates that were automatically propagated to users. The attribution is of medium confidence based on shared TTPs and infrastructure. The campaign employed sophisticated evasion techniques including splitting malicious code, multi-stage encrypted payloads, environment-aware execution, and exploitation of AI-generated package name typosquatting. Amazon is responding by sharing intelligence, collaborating with OpenSSF and others, and funding the Akrites initiative to defend open-source software against AI-enabled supply chain threats.

The supply chain attacks compromised widely used npm packages, including debug, chalk, and axios, potentially affecting a large number of downstream users and cloud environments. The malicious updates were automatically distributed, increasing the risk of widespread impact. The attacks enable indirect access to numerous victims through trusted packages, posing a significant risk to software supply chain integrity and security. The use of advanced evasion techniques complicates detection and mitigation efforts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Amazon is actively collaborating with the open-source community and industry partners to address these threats. Security teams should monitor official advisories from npm, package maintainers, and security organizations for updates on patched versions or mitigations. Users should verify package integrity and maintain vigilance against suspicious package updates. No specific patches or fixes are detailed in the provided information.