Amazon Attributes the debug and chalk npm Compromise to a North Korean Threat Group

On July 29, 2026, Amazon Threat Intelligence linked the September 2025 hijack of debug and chalk to a North Korean actor with medium confidence. The campaign affected at least 18 npm packages with more than 2 billion combined weekly downloads. Amazon believes the same group later compromised axios in March 2026; it reported no new breach.

Why the attribution matters

The original incident was documented as cryptocurrency theft after a maintainer entered credentials on a lookalike npm domain. Malicious browser code then intercepted fetch, XMLHttpRequest and wallet APIs to replace transaction addresses before users signed transfers.

Amazon now connects that operation to the actor behind axios. Microsoft tracks the overlapping activity as Sapphire Sleet, while Google attributed axios to UNC1069. However, Amazon remains the sole attribution source for the debug, chalk and typo-crypto incidents.

Evidence and unresolved discrepancies

Amazon cites shared tradecraft, reused code and overlapping command-and-control indicators. It also identifies typo-crypto@4.3.0, published in March 2025, as a possible test run. Its core.js file waited for a specific hash prefix before retrieving an OS-specific payload from a hardcoded server.

“The tradecraft aligns with what we later observed in attacks on more popular packages.”

The public registry record complicates that assessment. typo-crypto had only one version, its publisher differed from the named author, and its metadata copied crypto-js. The package was still installable on July 30, 2026, although it had no install script and downloading it alone did not execute the payload. The reported core.js hash also matched no file in the registry tarball.

For businesses, the practical lesson is that disabling lifecycle scripts is insufficient. npm v12 blocks dependency scripts by default, and npm now scans new publications before release, but neither control eliminates phishing-led maintainer compromise. Teams still need locked dependencies, provenance checks, rapid cache purges and monitoring for unexpected browser-side behavior.